LazyScripter - G0140

Created: 2021-11-24T19:26:27.305Z

Modified: 2023-03-22T04:49:29.731Z

Contributors: Manikantan Srinivasan, NEC Corporation India,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

LazyScripter

Description

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)

Techniques Used

LazyScripter has established GitHub accounts to host its toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

LazyScripter has used a variety of open-source remote access Trojans for its operations.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

LazyScripter had downloaded additional tools to a compromised host.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

LazyScripter has relied upon users clicking on links to malicious files.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|