1. Home
  2. Software
  3. Nebulae

Nebulae

Nebulae Is a backdoor that has been used by Naikon since at least 2020.[1]

ID: S0630
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 30 June 2021
Last Modified: 15 October 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

Nebulae has the capability to upload collected files to C2.[1]
Enterprise T1036 .004 伪装: Masquerade Task or Service

Nebulae has created a service named "Windows Update Agent1" to appear legitimate.[1]
.005 伪装: Match Legitimate Name or Location

Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.[1]
Enterprise T1543 .003 创建或修改系统进程: Windows Service

Nebulae can create a service to establish persistence.[1]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

Nebulae can use RC4 and XOR to encrypt C2 communications.[1]
Enterprise T1574 .002 劫持执行流: DLL Side-Loading

Nebulae can use DLL side-loading to gain execution.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Nebulae can achieve persistence through a Registry Run key.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Nebulae can use CMD to execute a process.[1]
Enterprise T1083 文件和目录发现

Nebulae can list files and directories on a compromised host.[1]
Enterprise T1106 本机API

Nebulae has the ability to use CreateProcess to execute a process.[1]
Enterprise T1070 .004 移除指标: File Deletion

Nebulae has the ability to delete files and directories.[1]
Enterprise T1082 系统信息发现

Nebulae can discover logical drive information including the drive type, free space, and volume information.[1]
Enterprise T1105 输入工具传输

Nebulae can download files from C2.[1]
Enterprise T1057 进程发现

Nebulae can enumerate processes on a target system.[1]
Enterprise T1095 非应用层协议

Nebulae can use TCP in C2 communications.[1]

Groups That Use This Software

ID Name References
G0019 Naikon

[1]

References

  1. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.