See Your Attack Surface Before Adversaries Do.

Phishing: Spearphishing Link

[UNC-1549] Adversaries are utilizing fake career portals and recruitment lures to deliver multi-stage malware to aerospace and defense targets.

Credentials from Web Browsers

[UNC-1549] The use of specialized browser credential stealers has been observed to harvest sensitive authentication data from compromised systems.

Command and Scripting Interpreter: PowerShell

[APT-XX] Recent campaigns involve the execution of obfuscated PowerShell scripts to facilitate the deployment of persistent Remote Access Trojans.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[APT-XX] Threat actors are maintaining persistence on developer environments by modifying registry keys to ensure malware execution upon system reboot.

Application Layer Protocol: Web Protocols

[UNC-1549] Operators are leveraging encrypted channels over standard web protocols to exfiltrate data and communicate with command-and-control infrastructure.

Screen Capture

[UNC-1549] The deployment of custom screenshot capture utilities is being used to monitor victim activity and gather intelligence from compromised workstations.

Steal or Forge Kerberos Tickets: Golden Ticket

[APT-XX] Observed activity indicates the exploitation of identity tokens to facilitate lateral movement within high-value corporate networks.

Exploit Public-Facing Application

[UNC-XXXX] Adversaries are actively scanning for and exploiting vulnerabilities in public-facing services to gain initial entry into developer environments.

File and Directory Discovery

[APT-XX] Threat actors are performing automated discovery of file systems to identify sensitive source code and configuration files for exfiltration.

Data Encrypted for Impact

[UNC-XXXX] Increased activity involving the encryption of critical data for extortion purposes has been observed across multiple industry sectors.

Phishing: Spearphishing Link

[UNC-1549] Adversaries are utilizing fake career portals and recruitment lures to deliver multi-stage malware to aerospace and defense targets.

Credentials from Web Browsers

[UNC-1549] The use of specialized browser credential stealers has been observed to harvest sensitive authentication data from compromised systems.

Command and Scripting Interpreter: PowerShell

[APT-XX] Recent campaigns involve the execution of obfuscated PowerShell scripts to facilitate the deployment of persistent Remote Access Trojans.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[APT-XX] Threat actors are maintaining persistence on developer environments by modifying registry keys to ensure malware execution upon system reboot.

Application Layer Protocol: Web Protocols

[UNC-1549] Operators are leveraging encrypted channels over standard web protocols to exfiltrate data and communicate with command-and-control infrastructure.

Screen Capture

[UNC-1549] The deployment of custom screenshot capture utilities is being used to monitor victim activity and gather intelligence from compromised workstations.

Steal or Forge Kerberos Tickets: Golden Ticket

[APT-XX] Observed activity indicates the exploitation of identity tokens to facilitate lateral movement within high-value corporate networks.

Exploit Public-Facing Application

[UNC-XXXX] Adversaries are actively scanning for and exploiting vulnerabilities in public-facing services to gain initial entry into developer environments.

File and Directory Discovery

[APT-XX] Threat actors are performing automated discovery of file systems to identify sensitive source code and configuration files for exfiltration.

Data Encrypted for Impact

[UNC-XXXX] Increased activity involving the encryption of critical data for extortion purposes has been observed across multiple industry sectors.