Patchfirst

Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data

documents.trendmicro.com · Undated · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

2 CVEs
  1. CVE-2018-0802Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1203Exploitation for Client Execution8 reports
    93.3%Top 0.17%
    88.4priority
  2. CVE-2018-0798Microsoft Office Memory Corruption Vulnerability
    Microsoft · OfficeKEVPublic exploitHigh · 8.8T1204.002Malicious FileT1203Exploitation for Client Execution5 reports
    95.1%Top 0.14%
    79.1priority

Where it names them

CVE-2018-0802
In early 2019, TICK began implementing techniques that exploit vulnerabilities CVE-2018-0802 and
Original (opens in a new tab) ↗
CVE-2018-0802
Original (opens in a new tab) ↗
Exploiting CVE-2018-0802 and CVE-2018-0798 for downloader’s deployment
Original (opens in a new tab) ↗
ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and
Original (opens in a new tab) ↗
CVE-2018-0798
CVE-2018-0798 into their new downloaders ABK and BBK.
Original (opens in a new tab) ↗
Exploiting CVE-2018-0802 and CVE-2018-0798 for downloader’s deployment
Original (opens in a new tab) ↗
x MITRE ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and CVE- 2018-0798
Original (opens in a new tab) ↗

Techniques drawn from this report

2 links, in kill-chain order

Execution Exploitation for Client Execution T1203 for CVE-2018-0798

MITRE CTID mapping of the CVE

x MITRE ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and CVE- 2018-0798
Original (opens in a new tab) ↗

Execution Exploitation for Client Execution T1203 for CVE-2018-0802

AI mapping from the description

ATT&CK Techniques Tactic Technique ID Description Initial Access Spearphishing Attachment T1193 Used to deliver first stage malware Supply Chain Compromise T1195 Used for initial intrusion on subsidiaries Execution Exploitation for Client Execution T1203 Used to exploit CVE-2018-0802 and
Original (opens in a new tab) ↗
↑ ↓ chooseEnter openEsc close