NanHaiShu

Malware & Tools · NanHaiShu

· MalwareS0228 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute. (Citation: Proofpoint Leviathan Oct 2017) (Citation: fsecure NanHaiShu July 2016)

Tactic Coverage

discovery (3)stealth (3)execution (2)command and control (2)persistence (1)privilege escalation (1)defense impairment (1)

Used By (1 groups)

G0065LeviathanMUDCARP, Kryptonite Panda

Techniques (12)

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1059.005Visual Basic

execution

T1059.007JavaScript

execution

T1070.004File Deletion

stealth

T1071.004DNS

References

https://attack.mitre.org/software/S0228 https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf