Article Content Intrusions Focus on the Engineering and Maritime Sector Since early 2018, FireEye (including our FireEye as a Service (FaaS), Mandiant Consulting, and iSIGHT Intelligence teams) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities, especially those connected to South China Sea issues The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013, dubbed TEMP.Periscope The group has also been reported as “Leviathan” by other security firms The current campaign is a sharp escalation of detected activity since summer 2017 Like multiple other Chinese cyber espionage actors, TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit Known targets of this group have been involved in the maritime industry, as well as engineering-focused entities, and include research institutes, academic organizations, and private firms in the United States FireEye products have robust detection for the malware used in this campaign TEMP.Periscope Background Active since at least 2013, TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals, including engineering firms, shipping and transportation, manufacturing, defense, government offices, and research universities However, the group has also targeted professional/consulting services, high-tech industry, healthcare, and media/publishing Identified victims were mostly found in the United States, although organizations in Europe and at least one in Hong Kong have also been affected TEMP.Periscope overlaps in targeting, as well as tactics, techniques, and procedures (TTPs), with TEMP.Jumper, a group that also overlaps significantly with public reporting on “NanHaiShu.” TTPs and Malware Used In their recent spike in activity, TEMP.Periscope has leveraged a relatively large library of malware shared with multiple other suspected Chinese groups These tools include:  AIRBREAK: a JavaScript-based backdoor also reported as “Orz” that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors LUNCHMONEY: an uploader that can exfiltrate files to Dropbox China Chopper: a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands The following are tools that TEMP.Periscope has leveraged in past operations and could use again, though these have not been seen in the current wave of activity:  Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform, commonly used for pen-testing network environments BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal Used by APT17 and other Chinese cyber espionage operators Additional identifying TTPs include:  Spear phishing, including the use of probably compromised email accounts Lure documents using CVE-2017-11882 to drop malware Use of bitsadmin.exe to download additional tools Using C:\Windows\Debug and C:\Perflogs as staging directories Leveraging Hyperhost VPS and Proton VPN exit nodes to access webshells on internet-facing systems Using Windows Management Instrumentation (WMI) for persistence Implications The current wave of identified intrusions is consistent with TEMP.Periscope and likely reflects a concerted effort to target sectors that may yield information that could provide an economic advantage, research and development data, intellectual property, or an edge in commercial negotiations As we continue to investigate this activity, we may identify additional data leading to greater analytical confidence linking the operation to TEMP.Periscope or other known threat actors, as well as previously unknown campaigns
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Intrusions Focus on the Engineering and Maritime Sector Since early 2018, FireEye (including our FireEye as a Service (FaaS), Mandiant Consulting, and iSIGHT Intelligence teams) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities, especially those connected to South China Sea issues The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013, dubbed TEMP.Periscope The group has also been reported as “Leviathan” by other security firms The current campaign is a sharp escalation of detected activity since summer 2017 Like multiple other Chinese cyber espionage actors, TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit Known targets of this group have been involved in the maritime industry, as well as engineering-focused entities, and include research institutes, academic organizations, and private firms in the United States FireEye products have robust detection for the malware used in this campaign TEMP.Periscope Background Active since at least 2013, TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals, including engineering firms, shipping and transportation, manufacturing, defense, government offices, and research universities However, the group has also targeted professional/consulting services, high-tech industry, healthcare, and media/publishing Identified victims were mostly found in the United States, although organizations in Europe and at least one in Hong Kong have also been affected TEMP.Periscope overlaps in targeting, as well as tactics, techniques, and procedures (TTPs), with TEMP.Jumper, a group that also overlaps significantly with public reporting on “NanHaiShu.” TTPs and Malware Used In their recent spike in activity, TEMP.Periscope has leveraged a relatively large library of malware shared with multiple other suspected Chinese groups These tools include:  AIRBREAK: a JavaScript-based backdoor also reported as “Orz” that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors LUNCHMONEY: an uploader that can exfiltrate files to Dropbox China Chopper: a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands The following are tools that TEMP.Periscope has leveraged in past operations and could use again, though these have not been seen in the current wave of activity:  Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform, commonly used for pen-testing network environments BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal Used by APT17 and other Chinese cyber espionage operators Additional identifying TTPs include:  Spear phishing, including the use of probably compromised email accounts Lure documents using CVE-2017-11882 to drop malware Use of bitsadmin.exe to download additional tools Using C:\Windows\Debug and C:\Perflogs as staging directories Leveraging Hyperhost VPS and Proton VPN exit nodes to access webshells on internet-facing systems Using Windows Management Instrumentation (WMI) for persistence Implications The current wave of identified intrusions is consistent with TEMP.Periscope and likely reflects a concerted effort to target sectors that may yield information that could provide an economic advantage, research and development data, intellectual property, or an edge in commercial negotiations As we continue to investigate this activity, we may identify additional data leading to greater analytical confidence linking the operation to TEMP.Periscope or other known threat actors, as well as previously unknown campaigns ### Response: .