Operation Ghost

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

This is a historical record and does not establish current campaign activity.

Threat actor

APT29

Attribution confidence

Not established

First documented activity

2013-09-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2013-09-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2019-10-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.(Citation: ESET Dukes October 2019)

• T1102.002 · Bidirectional Communication

  Command And Control — For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.(Citation: ESET Dukes October 2019)

• T1001.002 · Steganography

  Command And Control — During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.(Citation: ESET Dukes October 2019)

• T1583.001 · Domains

  Resource Development — For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.(Citation: ESET Dukes October 2019)

• T1587.001 · Malware

  Resource Development — For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.(Citation: ESET Dukes October 2019)

• T1546.003 · Windows Management Instrumentation Event Subscription

  Privilege Escalation, Persistence — During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.(Citation: ESET Dukes October 2019)

• T1585.001 · Social Media Accounts

  Resource Development — For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.(Citation: ESET Dukes October 2019)

• T1027.003 · Steganography

  Stealth — During Operation Ghost, APT29 used steganography to hide payloads inside valid images.(Citation: ESET Dukes October 2019)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0023

  Official MITRE ATT&CK campaign record C0023. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.