C0018

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0018 was a month-long ransomware intrusion that successfully deployed AvosLocker onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing AvosLocker.(Citation: Costa AvosLocker May 2022)(Citation: Cisco Talos Avos Jun 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2022-02-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-02-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-03-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1190 · Exploit Public-Facing Application

  Initial Access — During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.(Citation: Cisco Talos Avos Jun 2022)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.(Citation: Cisco Talos Avos Jun 2022)

• T1571 · Non-Standard Port

  Command And Control — During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.(Citation: Costa AvosLocker May 2022)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.(Citation: Costa AvosLocker May 2022)

• T1219.002 · Remote Desktop Software

  Command And Control — During C0018, the threat actors used AnyDesk to transfer tools between systems.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1033 · System Owner/User Discovery

  Discovery — During C0018, the threat actors collected `whoami` information via PowerShell scripts.(Citation: Costa AvosLocker May 2022)

• T1486 · Data Encrypted for Impact

  Impact — During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1046 · Network Service Discovery

  Discovery — During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.(Citation: Cisco Talos Avos Jun 2022)

• T1059.001 · PowerShell

  Execution — During C0018, the threat actors used encoded PowerShell scripts for execution.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1027.010 · Command Obfuscation

  Stealth — During C0018, the threat actors used Base64 to encode their PowerShell scripts.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1016 · System Network Configuration Discovery

  Discovery — During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.(Citation: Costa AvosLocker May 2022)

• T1588.002 · Tool

  Resource Development — For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1071.001 · Web Protocols

  Command And Control — During C0018, the threat actors used HTTP for C2 communications.(Citation: Costa AvosLocker May 2022)

• T1072 · Software Deployment Tools

  Execution, Lateral Movement — During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.(Citation: Cisco Talos Avos Jun 2022)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1036 · Masquerading

  Stealth — During C0018, AvosLocker was disguised using the victim company name as the filename.(Citation: Cisco Talos Avos Jun 2022)

• T1047 · Windows Management Instrumentation

  Execution — During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.(Citation: Cisco Talos Avos Jun 2022)(Citation: Costa AvosLocker May 2022)

• T1218.011 · Rundll32

  Stealth — During C0018, the threat actors used `rundll32` to run Mimikatz.(Citation: Costa AvosLocker May 2022)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0018

  Official MITRE ATT&CK campaign record C0018. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.