Sowbug - G0054

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-03-30T02:46:16.483Z

Contributors: Alan Neville, @abnev

Aliases

Sowbug

Description

Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. (Citation: Symantec Sowbug Nov 2017)

Techniques Used

Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory

Sowbug has used command line during its intrusions.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Sowbug extracted Word documents from a file server on a victim network.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Sowbug listed remote shared drives that were accessible from a victim.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Sowbug has used credential dumping tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Sowbug extracted documents and bundled them into a RAR archive.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sowbug has used keylogging tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|