Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.(Citation: Unit42 Emissary Panda May 2019)    |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Threat Group-3390 has used a variety of Web shells.(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|A

Threat Group-3390 tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Threat Group-3390's malware can add a Registry key to

Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|A

Threat Group-3390 tool can encrypt payloads using XOR.

Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|A