WellMess

Malware & Tools · WellMess

· MalwareS0514 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

WellMess is lightweight malware family with variants written in .NET and Golang that has been in use since at least 2018 by APT29.(Citation: CISA WellMess July 2020)(Citation: PWC WellMess July 2020)(Citation: NCSC APT29 July 2020)

Tactic Coverage

command and control (7)discovery (4)execution (2)collection (1)stealth (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (15)

T1001.001Junk Data

command and control

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1033System Owner/User Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1069.002Domain Groups

References

https://attack.mitre.org/software/S0514 https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf