XTunnel

Malware & Tools · XTunnel

· MalwareS0117 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

XTunnel a VPN-like network proxy tool that can relay traffic between a C2 server and a victim. It was first seen in May 2013 and reportedly used by APT28 during the compromise of the Democratic National Committee. (Citation: Crowdstrike DNC June 2016) (Citation: Invincea XTunnel) (Citation: ESET Sednit Part 2)

Tactic Coverage

command and control (3)stealth (2)discovery (1)execution (1)credential access (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (8)

T1008Fallback Channels

command and control

T1027Obfuscated Files or Information

stealth

T1027.016Junk Code Insertion

stealth

T1046Network Service Discovery

discovery

T1059.003Windows Command Shell

execution

T1090Proxy

command and control

T1552.001Credentials In Files

References

https://attack.mitre.org/software/S0117 https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-the-russian-xtunnel/http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf https://www.symantec.com/blogs/election-security/apt28-espionage-military-government