StrongPity Expand It's Target

Promethium APT-C-41

StrongPity, also known as APT-C-41 and Promethium, is a cyber espionage group that has been active since at least 2012. The group's initial focus was on targeting individuals and organizations in Syria and Turkey, but their campaigns have since expanded to encompass a wider range of targets across Africa, Asia, Europe, and North America. The group uses various methods such as watering hole attacks and phishing messages to infiltrate targeted systems and steal sensitive information. These attacks are designed to activate the killchain, which is the sequence of actions taken by the attackers to gain access, establish control, and exfiltrate data from the targeted systems.

Indicators of Compromise

Domains (10)

cybertik.netnetworksoftwaresegment.comhostoperationsystems.comupeg-system-app.comintagrefedcircuitchip.comegov.synetworktopologymaps.comwww.upn-sec3-msd.comconfig.propertiesupn-sec3-msd.com

Hashes (35)

d44818c061269930e50868445a3418a0780903fea9378a5469319faffc48f3aa70f5b352d5acb7d361c5177a9aac90d9c58bb628f105ea7298ab01427d81a440f35df9703ea33aa85a15f516d5c58b23e19d6a39325b4b5c5590bde062eab80792db53bf945ff0f835790d3648f67be806b4e823280f03ee5512ffd58deb6f37ecc80842265d4e8d2ca30055d9d34d6627ae3150bd574b6523995d9a3bfad08b9ac63af5ecf9aa59265ed24d0c76d91e374d92f553c28e9dad1aa7f5d334a07dede1e5ad19c3766efde74290d0c49afbd9a71b13d3061be12ee4905647ddc2f1189f00debe1593bd1f1d5a4d05217f0492832e13bddd61281d8e109668ea5c64920fe9b2596257ef017b02ba6961869d78a2317500a45f00c76682a22bbdbd3391857b5d5a5910c2c9180382fcf7a939e9909044f0e8918b75dc2829abb951ff970debfba9f66d4d7c6b7c48a823a911dd5874f74ac63d7bcc7105b1e9a798eacc0adbcd04cd8aff3f936ea1d011d9fa916bce7176f88a1045cd53f0f754874a76e3b75a5a5c7fe849ddae318946973ba7213981f02648a9260e69b8eaac2f3ce46b76cadbd7261fe750dbb9b0a82f262afeb29869bf7bc92cadd1b7f14ef888670553e6+15 more

IPv4 (2)

185.12.46.138141.255.161.185

APT Groups

PROMETHIUM

Turkey

Notes

<div>StrongPity is a type of malware that has been used in targeted attacks against individuals and organizations. It is a type of APT (Advanced Persistent Threat) malware, which is designed to evade detection and maintain a persistent presence on a compromised system. The malware is typically delivered via phishing emails or malicious websites, and once installed, it can gather information, steal credentials, and open a backdoor to the attackers.</div><div> </div><div>Promethium APT is a cyber espionage group that is known to target government organizations, defense contractors, and other high-value targets. The group is thought to be operating out of Russia and is believed to be using a number of different malware tools, including StrongPity, in order to gain access to target systems and exfiltrate data. It is a highly sophisticated APT group that is known to use advanced techniques to evade detection and maintain a presence on infected systems.</div><div> </div><div>In general, both StrongPity and Promethium APT are considered to be very serious threats and organizations should take steps to protect themselves from these types of attacks. This includes implementing security best practices such as patching systems regularly, using anti-virus software, and educating employees about the risks of phishing emails and other social engineering tactics.</div>

Mitigation

Techniques Used <table class="MsoNormalTable" border="1" cellspacing="0" cellpadding="0" style="width: 1025.45pt; background-image: initial; background-position: initial; background-size: initial; background-repeat: initial; background-attachment: initial; background-origin: initial; background-clip: initial; border-collapse: collapse; border: none;"> <thead> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:solid #DEE2E6 1.5pt; background:#F2F2F2;padding:.75pt .75pt .75pt .75pt;"> Domain </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt; border-left:none;border-bottom:solid #DEE2E6 1.5pt;border-right:solid #DFDFDF 1.0pt; background:#F2F2F2;padding:.75pt .75pt .75pt .75pt;"> ID </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:solid #DEE2E6 1.5pt;border-right:solid #DFDFDF 1.0pt; background:#F2F2F2;padding:.75pt .75pt .75pt .75pt;"> Name </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:solid #DEE2E6 1.5pt;border-right:solid #DFDFDF 1.0pt; background:#F2F2F2;padding:.75pt .75pt .75pt .75pt;"> Use </td> </tr> </thead> <tbody><tr> <td style="border-top:none;border-left:solid #DFDFDF 1.0pt; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> T1071 </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> .001 </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1071">Application Layer Protocol</a>: <a href="https://attack.mitre.org/techniques/T1071/001">Web Protocols</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can use HTTP and HTTPS in C2 communications. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1560">T1560</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1560/003">.003</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1560">Archive Collected Data</a>: <a href="https://attack.mitre.org/techniques/T1560/003">Archive via Custom Method</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1119">T1119</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1119">Automated Collection</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1020">T1020</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1020">Automated Exfiltration</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can automatically exfiltrate collected documents to the C2 server. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1547">T1547</a> </td> <td style="border:solid #DFDFDF 1.0pt;border-left:none;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1547/001">.001</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1547">Boot or Logon Autostart Execution</a>: <a href="https://attack.mitre.org/techniques/T1547/001">Registry Run Keys / Startup Folder</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1059">T1059</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1059/001">.001</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1059">Command and Scripting Interpreter</a>: <a href="https://attack.mitre.org/techniques/T1059/001">PowerShell</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can use PowerShell to add files to the Windows Defender exclusions list. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1543">T1543</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1543/003">.003</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1543">Create or Modify System Process</a>: <a href="https://attack.mitre.org/techniques/T1543/003">Windows Service</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has created new services and modified existing services for persistence. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1573">T1573</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1573/002">.002</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1573">Encrypted Channel</a>: <a href="https://attack.mitre.org/techniques/T1573/002">Asymmetric Cryptography</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has encrypted C2 traffic using SSL/TLS. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1041">T1041</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1041">Exfiltration Over C2 Channel</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can exfiltrate collected documents through C2 channels. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1083">T1083</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1083">File and Directory Discovery</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can parse the hard drive on a compromised host to identify specific file extensions. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1564">T1564</a> </td> <td style="border:solid #DFDFDF 1.0pt;border-left:none;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1564/003">.003</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1564">Hide Artifacts</a>: <a href="https://attack.mitre.org/techniques/T1564/003">Hidden Window</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has the ability to hide the console window for its document search module from the user. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1562">T1562</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1562/001">.001</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1562">Impair Defenses</a>: <a href="https://attack.mitre.org/techniques/T1562/001">Disable or Modify Tools</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can add directories used by the malware to the Windows Defender exclusions list to prevent detection. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1070">T1070</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1070/004">.004</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1070">Indicator Removal</a>: <a href="https://attack.mitre.org/techniques/T1070/004">File Deletion</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can delete previously exfiltrated files from the compromised host. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1105">T1105</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1105">Ingress Tool Transfer</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can download files to specified targets. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1036">T1036</a> </td> <td style="border:solid #DFDFDF 1.0pt;border-left:none;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1036/004">.004</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1036">Masquerading</a>: <a href="https://attack.mitre.org/techniques/T1036/004">Masquerade Task or Service</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has named services to appear legitimate. </td> </tr> <tr> <td width="40" style="width:30.0pt;border-top:none;border-left:solid #DFDFDF 1.0pt; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"></td> <td width="40" style="width:30.0pt;border:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"></td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1036/005">.005</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1036">Masquerading</a>: <a href="https://attack.mitre.org/techniques/T1036/005">Match Legitimate Name or Location</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has been bundled with legitimate software installation files for disguise. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1571">T1571</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1571">Non-Standard Port</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has used HTTPS over port 1402 in C2 communication. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1027">T1027</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1027">Obfuscated Files or Information</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has used encrypted strings in its dropper component. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1057">T1057</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1057">Process Discovery</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can determine if a user is logged in by checking to see if explorer.exe is running. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1090">T1090</a> </td> <td style="border:solid #DFDFDF 1.0pt;border-left:none;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1090/003">.003</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1090">Proxy</a>: <a href="https://attack.mitre.org/techniques/T1090/003">Multi-hop Proxy</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can use multiple layers of proxy servers to hide terminal nodes in its infrastructure. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1518">T1518</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1518/001">.001</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1518">Software Discovery</a>: <a href="https://attack.mitre.org/techniques/T1518/001">Security Software Discovery</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can identify if ESET or BitDefender antivirus are installed before dropping its payload. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1553">T1553</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1553/002">.002</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1553">Subvert Trust Controls</a>: <a href="https://attack.mitre.org/techniques/T1553/002">Code Signing</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has been signed with self-signed certificates. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1082">T1082</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1082">System Information Discovery</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can identify the hard disk volume serial number on a compromised host. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td colspan="2" style="border-top:solid #DFDFDF 1.0pt;border-left: none;border-bottom:none;border-right:solid #DFDFDF 1.0pt;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1016">T1016</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1016">System Network Configuration Discovery</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can identify the IP address of a compromised host. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1569">T1569</a> </td> <td style="border:solid #DFDFDF 1.0pt;border-left:none;padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1569/002">.002</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1569">System Services</a>: <a href="https://attack.mitre.org/techniques/T1569/002">Service Execution</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> can install a service to execute itself as a service. </td> </tr> <tr> <td style="border:solid #DFDFDF 1.0pt;border-bottom:none; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> Enterprise </td> <td style="border-top:solid #DFDFDF 1.0pt;border-left:none; border-bottom:none;border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1204">T1204</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1204/002">.002</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/techniques/T1204">User Execution</a>: <a href="https://attack.mitre.org/techniques/T1204/002">Malicious File</a> </td> <td style="border-top:none;border-left:none;border-bottom:solid #DFDFDF 1.0pt; border-right:solid #DFDFDF 1.0pt; padding:7.5pt 7.5pt 7.5pt 7.5pt;"> <a href="https://attack.mitre.org/software/S0491">StrongPity</a> has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities. </td> </tr> </tbody></table> It is recommended to only download software from the official Google Play Store and to be cautious of apps from third-party sources. Be wary of apps that request excessive permissions or accessibility services.  Keep in mind that rooting a device can decrease its protection against malware. Mitigating the threat posed by groups like StrongPity requires a multi-layered approach that includes both technical and non-technical measures. Some steps that organizations can take to protect themselves from this type of attack include:Implementing strong security controls: Organizations should ensure that they have robust firewall and intrusion prevention systems in place to protect against known threats and detect and block malicious traffic.Regularly updating software and systems: Organizations should make sure that all software and systems are up-to-date with the latest security patches to address known vulnerabilities.Conducting regular security assessments: Organizations should conduct regular security assessments, including vulnerability scans and penetration testing, to identify and address potential security weaknesses.Employee awareness and training: Organizations should provide regular training to employees on how to identify and respond to phishing and social engineering attacks, as well as to be aware of the watering hole attack.Monitoring network and systems: Organizations should monitor their networks and systems for unusual activity, such as unexpected outbound connections or data exfiltration, and should have incident response plan in place.Getting external help: Organizations should consider hiring specialized security firms that can help to identify and mitigate the risk from APT groups.It is important to note that no single measure can fully protect against advanced persistent threats like StrongPity, and organizations should implement a combination of these measures to reduce the risk of a successful attack.