Alternative names (2)
TTPsInclude • usedTTPsRandom triples
| Subject | Object |
|---|---|
| gptkb:Stone_Panda | custom malware development |
| gptkb:Gamaredon | use of compromised email accounts |
| gptkb:APT41 | use of VPNs and proxies |
| gptkb:Conti_ransomware_campaigns | PowerShell scripts |
| gptkb:APT12 | watering hole attacks |
| gptkb:MuddyWater_group | credential harvesting |
| gptkb:MuddyWater_group | custom backdoors |
| gptkb:Winnti | custom malware development |
| gptkb:Conti_ransomware_campaigns | use of remote desktop protocol |
| gptkb:APT20 | lateral movement |
| gptkb:Gamaredon | use of legitimate cloud services for C2 |
| gptkb:APT54 | use of legitimate credentials |
| gptkb:APT20 | use of stolen credentials |
| gptkb:APT54 | use of web shells |
| gptkb:Conti_ransomware_campaigns | threatening data leaks |
| gptkb:APT41 | use of publicly available tools |
| gptkb:Conti_ransomware_campaigns | public shaming of victims |
| gptkb:Conti_ransomware_campaigns | remote access tools |
| gptkb:Turla_Group | use of legitimate software for persistence |
| gptkb:Conti_ransomware_campaigns | use of affiliate model |