C0021

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.(Citation: Microsoft Unidentified Dec 2018)(Citation: FireEye APT29 Nov 2018)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2018-11-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2018-11-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2018-11-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1583.001 · Domains

  Resource Development — For C0021, the threat actors registered domains for use in C2.(Citation: FireEye APT29 Nov 2018)

• T1218.011 · Rundll32

  Stealth — During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.(Citation: FireEye APT29 Nov 2018)

• T1027.010 · Command Obfuscation

  Stealth — During C0021, the threat actors used encoded PowerShell commands.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1584.001 · Domains

  Resource Development — For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.(Citation: Microsoft Unidentified Dec 2018)

• T1204.001 · Malicious Link

  Execution — During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.(Citation: FireEye APT29 Nov 2018)

• T1095 · Non-Application Layer Protocol

  Command And Control — During C0021, the threat actors used TCP for some C2 communications.(Citation: FireEye APT29 Nov 2018)

• T1588.002 · Tool

  Resource Development — For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1071.001 · Web Protocols

  Command And Control — During C0021, the threat actors used HTTP for some of their C2 communications.(Citation: FireEye APT29 Nov 2018)

• T1608.001 · Upload Malware

  Resource Development — For C0021, the threat actors uploaded malware to websites under their control.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1105 · Ingress Tool Transfer

  Command And Control — During C0021, the threat actors downloaded additional tools and files onto victim machines.(Citation: Microsoft Unidentified Dec 2018)(Citation: FireEye APT29 Nov 2018)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1566.002 · Spearphishing Link

  Initial Access — During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1573.002 · Asymmetric Cryptography

  Command And Control — During C0021, the threat actors used SSL via TCP port 443 for C2 communications.(Citation: FireEye APT29 Nov 2018)

• T1059.001 · PowerShell

  Execution — During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.(Citation: FireEye APT29 Nov 2018)(Citation: Microsoft Unidentified Dec 2018)

• T1027.009 · Embedded Payloads

  Stealth — For C0021, the threat actors embedded a base64-encoded payload within a LNK file.(Citation: Microsoft Unidentified Dec 2018)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0021

  Official MITRE ATT&CK campaign record C0021. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.