Operation Sharpshooter

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous Lazarus Group operations, including fake job recruitment lures and shared malware code.(Citation: McAfee Sharpshooter December 2018)(Citation: Bleeping Computer Op Sharpshooter March 2019)(Citation: Threatpost New Op Sharpshooter Data March 2019)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2017-09-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2017-09-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2019-03-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1559.002 · Dynamic Data Exchange

  Execution — During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.(Citation: McAfee Sharpshooter December 2018)

• T1584.004 · Server

  Resource Development — For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.(Citation: Bleeping Computer Op Sharpshooter March 2019)

• T1608.001 · Upload Malware

  Resource Development — For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.(Citation: McAfee Sharpshooter December 2018)

• T1583.006 · Web Services

  Resource Development — For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.(Citation: McAfee Sharpshooter December 2018)

• T1106 · Native API

  Execution — During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.(Citation: McAfee Sharpshooter December 2018)

• T1055 · Process Injection

  Stealth, Privilege Escalation — During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.(Citation: Threatpost New Op Sharpshooter Data March 2019)

• T1059.005 · Visual Basic

  Execution — During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.(Citation: McAfee Sharpshooter December 2018)

• T1547.001 · Registry Run Keys / Startup Folder

  Persistence, Privilege Escalation — During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.(Citation: McAfee Sharpshooter December 2018)

• T1105 · Ingress Tool Transfer

  Command And Control — During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.(Citation: McAfee Sharpshooter December 2018)

• T1587.001 · Malware

  Resource Development — For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.(Citation: McAfee Sharpshooter December 2018)

• T1204.002 · Malicious File

  Execution — During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.(Citation: McAfee Sharpshooter December 2018)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.(Citation: McAfee Sharpshooter December 2018)

• T1090 · Proxy

  Command And Control — For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.(Citation: Bleeping Computer Op Sharpshooter March 2019)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0013

  Official MITRE ATT&CK campaign record C0013. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.