Article Content APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability The use of CVE-2014-6332 is notable, as it demonstrates that multiple classes of actors, both criminal and APT alike, have now incorporated this exploit into their toolkits Further, the use of both of these two known vulnerabilities in tandem is notable for APT3 This actor is historically known for leveraging zero-day vulnerabilities in widespread but infrequent phishing campaigns The use of known exploits and more frequent attacks may indicate both a shift in strategy and operational tempo for this group The Spearphish The body of the message is below: One Month's Free Membership for The PLAYBOY ClUB 1080P HD VIDEOS 100,000 PHOTOS 4,000  MODELS Nude Celebrities,Playmates,Cybergirls & More! Click hxxp://join.playboysplus.com/signup/ To Get a Free Plus Member Now & Never Miss Another Update Your Member referrals must remain active If anyone getting "Promotion not available" for 1 month free membership, you might get the issue up to 48 hrs once your membership is expired and make sure to Clear out cookies or use another browser or use another PC This CVE is a local kernel vulnerability that, with successful exploitation, would give any user SYSTEM access on the machine The malware sends the SOCKS5 connection request "05 01 00" and verifies the server response starts with "05 00" Once the connection to the server is established, the malware expects a message containing at least three bytes from the server These first three bytes are the command identifier The deflated exe was a variant of the same downloader described above and connected to 198.55.115.71 over port 1913 via SOCKS5 proxy The secondary payload in that case was detected as Backdoor.APT.CookieCutter (aka Pirpi) and also named newnotepad.exe (MD5 8849538ef1c3471640230605c2623c67) and connected to the known APT3 domains:     inform.bedircati[.]com     pn.lamb-site[.]com     210.109.99.64 The 192.184.60.229 IP address seen in this current campaign also hosts securitywap[.]com – another known domain referenced in our Operation Clandestine Fox blog Conclusion Although APT3 is well known for employing zero-day exploits in their attacks, recent activity has demonstrated that they will also attack targets with known exploits or social engineering IOCs for this threat can be found here 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability The use of CVE-2014-6332 is notable, as it demonstrates that multiple classes of actors, both criminal and APT alike, have now incorporated this exploit into their toolkits Further, the use of both of these two known vulnerabilities in tandem is notable for APT3 This actor is historically known for leveraging zero-day vulnerabilities in widespread but infrequent phishing campaigns The use of known exploits and more frequent attacks may indicate both a shift in strategy and operational tempo for this group The Spearphish The body of the message is below: One Month's Free Membership for The PLAYBOY ClUB 1080P HD VIDEOS 100,000 PHOTOS 4,000  MODELS Nude Celebrities,Playmates,Cybergirls & More! Click hxxp://join.playboysplus.com/signup/ To Get a Free Plus Member Now & Never Miss Another Update Your Member referrals must remain active If anyone getting "Promotion not available" for 1 month free membership, you might get the issue up to 48 hrs once your membership is expired and make sure to Clear out cookies or use another browser or use another PC This CVE is a local kernel vulnerability that, with successful exploitation, would give any user SYSTEM access on the machine The malware sends the SOCKS5 connection request "05 01 00" and verifies the server response starts with "05 00" Once the connection to the server is established, the malware expects a message containing at least three bytes from the server These first three bytes are the command identifier The deflated exe was a variant of the same downloader described above and connected to 198.55.115.71 over port 1913 via SOCKS5 proxy The secondary payload in that case was detected as Backdoor.APT.CookieCutter (aka Pirpi) and also named newnotepad.exe (MD5 8849538ef1c3471640230605c2623c67) and connected to the known APT3 domains:     inform.bedircati[.]com     pn.lamb-site[.]com     210.109.99.64 The 192.184.60.229 IP address seen in this current campaign also hosts securitywap[.]com – another known domain referenced in our Operation Clandestine Fox blog Conclusion Although APT3 is well known for employing zero-day exploits in their attacks, recent activity has demonstrated that they will also attack targets with known exploits or social engineering IOCs for this threat can be found here  ### Response: .