CybercrimeMITRE G1018
TA2541
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Persistent cybercrime threat actor targeting aviation, aerospace, transportation, manufacturing, and defense industries for years. This threat actor consistently uses remote access trojans (RATs) that can be used to remotely control compromised machines. This threat actor uses consistent themes related to aviation, transportation, and travel. The threat actor has used similar themes and targeting since 2017.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1016.001 Internet Connection DiscoveryT1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1055 Process InjectionT1055.012 Process HollowingT1059.001 PowerShellT1059.005 Visual BasicT1082 System Information DiscoveryT1105 Ingress Tool TransferT1204.001 Malicious LinkT1204.002 Malicious FileT1218.005 MshtaT1518.001 Security Software DiscoveryT1547.001 Registry Run Keys / Startup FolderT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1568 Dynamic ResolutionT1573.002 Asymmetric CryptographyT1583.001 DomainsT1583.006 Web ServicesT1588.001 MalwareT1588.002 ToolT1608.001 Upload MalwareT1685 Disable or Modify Tools
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight
- https://attack.mitre.org/groups/G1018
- https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.