Operation Dust Storm

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm) Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2010-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2010-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2016-02-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1204.002 · Malicious File

  Execution — During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.(Citation: Cylance Dust Storm)

• T1204.001 · Malicious Link

  Execution — During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.(Citation: Cylance Dust Storm)

• T1583.001 · Domains

  Resource Development — For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.(Citation: Cylance Dust Storm)

• T1027.002 · Software Packing

  Stealth — For Operation Dust Storm, the threat actors used UPX to pack some payloads.(Citation: Cylance Dust Storm)

• T1566.001 · Spearphishing Attachment

  Initial Access — During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.(Citation: Cylance Dust Storm)

• T1189 · Drive-by Compromise

  Initial Access — During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.(Citation: Cylance Dust Storm)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.(Citation: Cylance Dust Storm)

• T1036 · Masquerading

  Stealth — For Operation Dust Storm, the threat actors disguised some executables as JPG files.(Citation: Cylance Dust Storm)

• T1218.005 · Mshta

  Stealth — During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.(Citation: Cylance Dust Storm)

• T1568 · Dynamic Resolution

  Command And Control — For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.(Citation: Cylance Dust Storm)

• T1059.005 · Visual Basic

  Execution — During Operation Dust Storm, the threat actors used Visual Basic scripts.(Citation: Cylance Dust Storm)

• T1518 · Software Discovery

  Discovery — During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.(Citation: Cylance Dust Storm)

• T1203 · Exploitation for Client Execution

  Execution — During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.(Citation: Cylance Dust Storm)

• T1059.007 · JavaScript

  Execution — During Operation Dust Storm, the threat actors used JavaScript code.(Citation: Cylance Dust Storm)

• T1585.002 · Email Accounts

  Resource Development — For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.(Citation: Cylance Dust Storm)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During Operation Dust Storm, attackers used VBS code to decode payloads.(Citation: Cylance Dust Storm)

• T1566.002 · Spearphishing Link

  Initial Access — During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.(Citation: Cylance Dust Storm)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0016

  Official MITRE ATT&CK campaign record C0016. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.