TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

TA551 has retrieved DLLs and installer binaries for malware execution from C2.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

TA551 has hidden encoded data for malware DLLs in a PNG.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TA551 has used HTTP for C2 communications.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

TA551 has used rundll32.exe to load malicious DLLs.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

TA551 has used regsvr32.exe to load malicious DLLs.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

TA551 has used encoded ASCII text for initial C2 communications.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

TA551 has masked malware DLLs as dat and jpg files.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

TA551 has used obfuscated variable names in a JavaScript configuration file.(Citation: Unit 42 Valak July 2020)|