NativeZone

Malware & Tools · NativeZone

· MalwareS0637 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

NativeZone is the name given collectively to disposable custom Cobalt Strike loaders used by APT29 since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)

Tactic Coverage

stealth (5)execution (1)discovery (1)

Used By (1 groups)

G0016APT29IRON RITUAL, IRON HEMLOCK

Techniques (6)

T1036Masquerading

stealth

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

T1218.011Rundll32

stealth

T1480Execution Guardrails

stealth

T1497.001System Checks

stealthdiscovery

References

https://attack.mitre.org/software/S0637 https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/