All C2s used in the Dear Joohn campaign were IP-based and examining the infrastructure did not provide significant overlap or relationships with previous Zebrocy or Sofacy infrastructure. A visual representation of the Dear Joohn campaign can be seen in Figure 6 Having three different C2 locations embedded inside these delivery documents while maintaining the exact same timestamping may indicate the use of an automated tool Using a command line based penetration testing toolkit such as Phishery could allow for simple scripting to generate multiple documents all at the same time with different inputs From there, there was an average of a two-week gap until these documents were first seen in the wild In total, these four documents had an average of roughly 46 days from initial creation to attack Based on the modular nature of the Dear Joohn campaign attacks, the lengthy amount of time from initial creation to attack may suggest the campaign was not yet ready for deployment due to additional development required for the remote templates, payloads, or infrastructure Another possible scenario is that the adversary may have had a certain timeframe they desired to execute the attack, and from the timeline it is clear there were two distinct targeting time frames, one from mid to late October 2018 and the other in mid-November 2018 As the campaign progressed, the operational tempo of the Dear Joohn campaign increased, with the total time from document creation to first seen dropping down to an average of roughly two days On average, there was a 13.8 hour gap between when the template document was last touched by the operator and when the delivery document is first observed in the wild This leads us to believe that the generation of the delivery documents were indeed part of a staging effort, first with the initial creation of the document, modification to it to communicate with a C2, then generating a remote template document just prior to launching the actual attack Analysis using timestamps is not always conclusive however With the notable exception of the Cannon tool, the first-stage tools are all variants of the Zebrocy Trojan The Zebrocy variants delivered in this campaign were written in several different languages, including Delphi, C# and VB.NET Information on the first-stage payloads delivered in this attack are listed in Table 4 SHA256  Compiled Variant C2   5173721f30
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: All C2s used in the Dear Joohn campaign were IP-based and examining the infrastructure did not provide significant overlap or relationships with previous Zebrocy or Sofacy infrastructure. A visual representation of the Dear Joohn campaign can be seen in Figure 6 Having three different C2 locations embedded inside these delivery documents while maintaining the exact same timestamping may indicate the use of an automated tool Using a command line based penetration testing toolkit such as Phishery could allow for simple scripting to generate multiple documents all at the same time with different inputs From there, there was an average of a two-week gap until these documents were first seen in the wild In total, these four documents had an average of roughly 46 days from initial creation to attack Based on the modular nature of the Dear Joohn campaign attacks, the lengthy amount of time from initial creation to attack may suggest the campaign was not yet ready for deployment due to additional development required for the remote templates, payloads, or infrastructure Another possible scenario is that the adversary may have had a certain timeframe they desired to execute the attack, and from the timeline it is clear there were two distinct targeting time frames, one from mid to late October 2018 and the other in mid-November 2018 As the campaign progressed, the operational tempo of the Dear Joohn campaign increased, with the total time from document creation to first seen dropping down to an average of roughly two days On average, there was a 13.8 hour gap between when the template document was last touched by the operator and when the delivery document is first observed in the wild This leads us to believe that the generation of the delivery documents were indeed part of a staging effort, first with the initial creation of the document, modification to it to communicate with a C2, then generating a remote template document just prior to launching the actual attack Analysis using timestamps is not always conclusive however With the notable exception of the Cannon tool, the first-stage tools are all variants of the Zebrocy Trojan The Zebrocy variants delivered in this campaign were written in several different languages, including Delphi, C# and VB.NET Information on the first-stage payloads delivered in this attack are listed in Table 4 SHA256  Compiled Variant C2   5173721f30 ### Response: .