BlackMould

Malware & Tools · BlackMould

· MalwareS0564 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

BlackMould is a web shell based on China Chopper for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by GALLIUM against telecommunication providers.(Citation: Microsoft GALLIUM December 2019)

Tactic Coverage

command and control (2)discovery (2)collection (1)execution (1)

Used By (1 groups)

G0093GALLIUMGranite Typhoon

Techniques (6)

T1005Data from Local System

collection

T1059.003Windows Command Shell

execution

T1071.001Web Protocols

command and control

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1680Local Storage Discovery

discovery

References

https://attack.mitre.org/software/S0564 https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/