BlackTech
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1190 | Exploit Public-Facing Application |
BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.[1] |
|
| Enterprise | T1203 | Exploitation for Client Execution |
BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119. |
|
| Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.[2] |
| Enterprise | T1036 | .002 | Masquerading: Right-to-Left Override |
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.[1] |
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
BlackTech has used spearphishing e-mails with malicious documents to deliver malware.[1] |
| .002 | Phishing: Spearphishing Link |
BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.[1] |
||
| Enterprise | T1204 | .001 | User Execution: Malicious Link |
BlackTech has used e-mails with malicious links to lure victims into installing malware.[1] |
| .002 | User Execution: Malicious File |
BlackTech has used e-mails with malicious documents to lure victims into installing malware.[1] |
||