C0010

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. C0010 began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2020-12-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2020-12-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1584.001 · Domains

  Resource Development — During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.(Citation: Mandiant UNC3890 Aug 2022)

• T1608.001 · Upload Malware

  Resource Development — For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.(Citation: Mandiant UNC3890 Aug 2022)

• T1189 · Drive-by Compromise

  Initial Access — During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.(Citation: Mandiant UNC3890 Aug 2022)

• T1608.004 · Drive-by Target

  Resource Development — For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.(Citation: Mandiant UNC3890 Aug 2022)

• T1587.001 · Malware

  Resource Development — For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.(Citation: Mandiant UNC3890 Aug 2022)

• T1583.001 · Domains

  Resource Development — For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.(Citation: Mandiant UNC3890 Aug 2022)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.(Citation: Mandiant UNC3890 Aug 2022)

• T1608.002 · Upload Tool

  Resource Development — For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.(Citation: Mandiant UNC3890 Aug 2022)

• T1588.002 · Tool

  Resource Development — For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.(Citation: Mandiant UNC3890 Aug 2022)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0010

  Official MITRE ATT&CK campaign record C0010. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.