TA459 - G0062

Created: 2018-04-18T17:59:24.739Z

Modified: 2020-03-30T19:22:32.962Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

TA459

Description

TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|TA459 has a VBScript for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|TA459 has used PowerShell for execution of a payload.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.(Citation: Proofpoint TA459 April 2017)|