🇷🇺

PhantomCore

APT Group 8 zero-day CVEs

Also Known As

No alias recorded

Target Countries 12

Countries highlighted in red

Belarus China Colombia Hong Kong Kazakhstan Lebanon Philippines Pakistan Russian Federation United States Uzbekistan Vietnam

Sectors Targeted

NAICS:48 48 Utilities 22 Construction 23 Legal Computer and Electronic Product Manufacturing 334 Ship Building and Repairing 336611 Chemical Manufacturing 325 Financial NAICS:31 31 Computer Systems Design Services 541512 Transportation Industrial Food Manufacturing 311 Manufacturing Logistics Justice, Public Order, and Safety Activities 922 Truck Transportation 484 Construction of Buildings 236 Defense Air Transportation 481 Information 51 Space Research and Technology 927 Healthcare All Energy Companies National Security and International Affairs 928 Other Services (except Public Administration) 81 High-Tech Computer Systems Design and Related Services 5415 Banks Health Care and Social Assistance 62 Software Publishers 5112 Aircraft Manufacturing 336411 Education Educational Services 61 Oil and Gas Mining, Quarrying, and Oil and Gas Extraction 21 Accommodation and Food Services 72 Finance and Insurance 52 Public Administration 92 IT Electronic Shopping and Mail-Order Houses 4541 Finance Government Arts, Entertainment, and Recreation 71 Professional, Scientific, and Technical Services 54 Couriers and Express Delivery Services 492110 Commercial Banking 52211 Oil and Gas Extraction 211 Water Transportation 483

Details

Origin 🇷🇺 RU
Last Updated 25 May 2024

Malware Families 4

cageychameleon
remcom
ave_maria
REMCOS

MITRE ATT&CK 61

T1003 - OS Credential Dumping T1007 - System Service Discovery T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.001 - Binary Padding T1027.002 - Software Packing T1033 - System Owner/User Discovery T1036 - Masquerading T1036.006 - Space after Filename T1041 - Exfiltration Over C2 Channel T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1055 - Process Injection T1056 - Input Capture T1056.001 - Keylogging T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.005 - Visual Basic T1071.001 - Web Protocols T1071.004 - DNS T1078 - Valid Accounts T1078.002 T1082 - System Information Discovery T1083 - File and Directory Discovery T1087 - Account Discovery T1087.001 T1090.001 T1090.003 - Multi-hop Proxy T1095 - Non-Application Layer Protocol T1102.002 - Bidirectional Communication T1105 - Ingress Tool Transfer T1124 - System Time Discovery T1132.001 - Standard Encoding T1134 - Access Token Manipulation T1140 - Deobfuscate/Decode Files or Information T1187 - Forced Authentication T1204.001 - Malicious Link T1204.002 - Malicious File T1212 - Exploitation for Credential Access T1486 - Data Encrypted for Impact T1490 - Inhibit System Recovery T1497 - Virtualization/Sandbox Evasion T1505 - Server Software Component T1518 - Software Discovery T1543.003 - Windows Service T1547.001 - Registry Run Keys / Startup Folder T1550 - Use Alternate Authentication Material T1552 - Unsecured Credentials T1557 - Man-in-the-Middle T1566 - Phishing T1566.001 - Spearphishing Attachment T1568.002 - Domain Generation Algorithms T1571 - Non-Standard Port T1573.001 - Symmetric Cryptography T1573.002 - Asymmetric Cryptography

Related Zero-Days 8

CVE-2018-0802 CVE-2020-0796 CVE-2021-26855 CVE-2021-26857 CVE-2021-26858 CVE-2021-27065 CVE-2023-38831 CVE-2025-55182