Whitefly - G0107

Created: 2020-05-26T16:55:09.674Z

Modified: 2021-10-12T21:43:24.133Z

Contributors:

Aliases

Whitefly

Description

Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)

Techniques Used

Whitefly has obtained and used tools such as

Mimikatz.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Whitefly has used

Mimikatz to obtain credentials.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Whitefly has used search order hijacking to run the loader Vcrodat.(Citation: Symantec Whitefly March 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Whitefly has encrypted the payload used for C2.(Citation: Symantec Whitefly March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Whitefly has the ability to download additional tools from the C2.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|