Penquin

Malware & Tools · Penquin

· MalwareS0587 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Linux

Description

Penquin is a remote access trojan (RAT) with multiple versions used by Turla to target Linux systems since at least 2014.(Citation: Kaspersky Turla Penquin December 2014)(Citation: Leonardo Turla Penquin May 2020)

Tactic Coverage

stealth (6)discovery (5)command and control (5)persistence (3)execution (2)credential access (1)exfiltration (1)privilege escalation (1)defense impairment (1)

Used By (1 groups)

G0010TurlaIRON HUNTER, Group 88

Techniques (18)

T1016System Network Configuration Discovery

discovery

T1027.005Indicator Removal from Tools

stealth

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1040Network Sniffing

credential accessdiscovery

T1041Exfiltration Over C2 Channel

exfiltration

References

https://attack.mitre.org/software/S0587 https://securelist.com/the-penquin-turla-2/67962/https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf