APT37

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to cap

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its priv

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large n

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of ca

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Di

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a met

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide da

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is activel

Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

BLUELIGHT is a remote access Trojan used by APT37 that was first o

CORALDECK is an exfiltration tool used by APT37. (Citation: FireEy

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

DOGCALL is a backdoor used by APT37 that has been used to target S

Final1stspy is a dropper family that has been used to deliver [DOGCALL](https://attack.mitre.org/software/S

HAPPYWORK is a downloader used by APT37 to target South Korean gov

KARAE is a backdoor typically used by APT37 as first-stage malware

NavRAT is a remote access tool designed to upload, download, and execute files. It has been observed in att

POORAIM is a backdoor used by APT37 in campaigns since at least 20

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to

SHUTTERSPEED is a backdoor used by APT37. (Citation: FireEye APT37

SLOWDRIFT is a backdoor used by APT37 against academic and strateg

WINERACK is a backdoor used by APT37. (Citation: FireEye APT37 Feb