UPPERCUT

Malware & Tools · UPPERCUT

· MalwareS0275 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

UPPERCUT is a 32-bit HTTP-based backdoor that has been used by menuPass since at least 2017.(Citation: FireEye APT10 Sept 2018) Once thought to be exclusive to menuPass, UPPERCUT was also observed being used by menuPass-associated MirrorFace during Operation AkaiRyū.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

Tactic Coverage

discovery (5)command and control (4)collection (2)execution (2)stealth (2)privilege escalation (1)

Used By (2 groups)

G1054MirrorFaceEarth Kasha G0045menuPassCicada, POTASSIUM

Techniques (15)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1033System Owner/User Discovery

discovery

T1059.003Windows Command Shell

execution

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

References

https://attack.mitre.org/software/S0275 https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html