WIRTE - G0090

Created: 2019-05-24T17:02:44.226Z

Modified: 2022-04-15T19:50:19.478Z

Contributors: Lab52 by S2 Grupo

Aliases

WIRTE

Description

WIRTE is a threat group that has been active since at least August 2018. WIRTE has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)

Techniques Used

WIRTE has used HTTPS over ports 2083 and 2087 for C2.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

WIRTE has named a first stage dropper

WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

WIRTE has obtained and used

Empire for post-exploitation activities.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

WIRTE has used Base64 to decode malicious VBS script.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

WIRTE has used