LazyScripter
LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1036 | 伪装 |
LazyScripter has used several different security software icons to disguise executables.[1] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.[1] |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
LazyScripter has used PowerShell scripts to execute malicious code.[1] |
| .003 | 命令与脚本解释器: Windows Command Shell |
LazyScripter has used batch files to deploy open-source and multi-stage RATs.[1] |
||
| .005 | 命令与脚本解释器: Visual Basic |
LazyScripter has used VBScript to execute malicious code.[1] |
||
| .007 | 命令与脚本解释器: JavaScript |
LazyScripter has used JavaScript in its attacks.[1] |
||
| Enterprise | T1071 | .004 | 应用层协议: DNS |
LazyScripter has leveraged dynamic DNS providers for C2 communications.[1] |
| Enterprise | T1608 | .001 | 暂存能力: Upload Malware |
LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.[1] |
| Enterprise | T1027 | .010 | 混淆文件或信息: Command Obfuscation |
LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.[1] |
| Enterprise | T1204 | .001 | 用户执行: Malicious Link |
LazyScripter has relied upon users clicking on links to malicious files.[1] |
| .002 | 用户执行: Malicious File |
LazyScripter has lured users to open malicious email attachments.[1] |
||
| Enterprise | T1218 | .005 | 系统二进制代理执行: Mshta |
LazyScripter has used |
| .011 | 系统二进制代理执行: Rundll32 |
LazyScripter has used |
||
| Enterprise | T1102 | 网络服务 |
LazyScripter has used GitHub to host its payloads to operate spam campaigns.[1] |
|
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.[1] |
| .006 | 获取基础设施: Web Services |
LazyScripter has established GitHub accounts to host its toolsets.[1] |
||
| Enterprise | T1588 | .001 | 获取能力: Malware |
LazyScripter has used a variety of open-source remote access Trojans for its operations.[1] |
| Enterprise | T1105 | 输入工具传输 |
LazyScripter had downloaded additional tools to a compromised host.[1] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.[1] |
| .002 | 钓鱼: Spearphishing Link |
LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.[1] |
||