C0032

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. C0032 was an extended campaign suspected to involve the Triton adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the Triton Safety Instrumented System Attack.(Citation: FireEye TRITON 2019)

This is a historical record and does not establish current campaign activity.

Threat actor

TEMP.Veles

Attribution confidence

Not established

First documented activity

2014-10-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2014-10-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2017-01-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1588.002 · Tool

  Resource Development — During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.(Citation: FireEye TRITON 2019)

• T1572 · Protocol Tunneling

  Command And Control — During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.(Citation: FireEye TRITON 2019)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the C0032 campaign, TEMP.Veles used compromised VPN accounts.(Citation: FireEye TRITON 2019)

• T1074.001 · Local Data Staging

  Collection — During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.(Citation: FireEye TRITON 2019)

• T1583.003 · Virtual Private Server

  Resource Development — During the C0032 campaign, TEMP.Veles used Virtual Private Server (VPS) infrastructure.(Citation: FireEye TRITON 2019)

• T1021.004 · SSH

  Lateral Movement — During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.(Citation: FireEye TRITON 2019)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.(Citation: FireEye TRITON 2019)

• T1505.003 · Web Shell

  Persistence — During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.(Citation: FireEye TRITON 2019)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.(Citation: FireEye TRITON 2019)

• T1571 · Non-Standard Port

  Command And Control — During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.(Citation: FireEye TRITON 2019)

• T1070.004 · File Deletion

  Stealth — During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)

• T1059.001 · PowerShell

  Execution — During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.(Citation: FireEye TRITON 2019)

• T1133 · External Remote Services

  Persistence, Initial Access — During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.(Citation: FireEye TRITON 2019)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.(Citation: FireEye TRITON 2019)

• T1070.006 · Timestomp

  Stealth — During the C0032 campaign, TEMP.Veles used timestomping to modify the <code>$STANDARD_INFORMATION</code> attribute on tools.(Citation: FireEye TRITON 2019)

• T1546.012 · Image File Execution Options Injection

  Privilege Escalation, Persistence — During the C0032 campaign, TEMP.Veles modified and added entries within <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</code> to maintain persistence.(Citation: FireEye TRITON 2019)

• T1003.001 · LSASS Memory

  Credential Access — During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.(Citation: FireEye TRITON 2019)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0032

  Official MITRE ATT&CK campaign record C0032. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.