C0010
C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. C0010 began by at least late 2020, and was still ongoing as of mid-2022.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1584 | .001 | 基础设施妥协: Domains |
During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.[1] |
| Enterprise | T1587 | .001 | 开发能力: Malware |
For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.[1] |
| Enterprise | T1608 | .001 | 暂存能力: Upload Malware |
For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.[1] |
| .002 | 暂存能力: Upload Tool |
For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.[1] |
||
| .004 | 暂存能力: Drive-by Target |
For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.[1] |
||
| Enterprise | T1189 | 浏览器攻击 |
During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.[1] |
|
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.[1] |
| Enterprise | T1588 | .002 | 获取能力: Tool |
For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.[1] |
| Enterprise | T1105 | 输入工具传输 |
During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.[1] |
|