RCSession

Malware & Tools · RCSession

· MalwareS0662 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

RCSession is a backdoor written in C++ that has been in use since at least 2018 by Mustang Panda and by Threat Group-3390 (Type II Backdoor).(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Trend Micro Iron Tiger April 2021)(Citation: Trend Micro DRBControl February 2020)

Tactic Coverage

stealth (7)command and control (4)collection (3)discovery (3)privilege escalation (3)execution (3)persistence (2)credential access (1)defense impairment (1)

Used By (2 groups)

G0129Mustang PandaTA416, RedDelta G0027Threat Group-3390Earth Smilodon, TG-3390

Techniques (22)

T1005Data from Local System

collection

T1027.011Fileless Storage

stealth

T1027.015Compression

stealth

T1033System Owner/User Discovery

discovery

T1036Masquerading

stealth

T1055.012Process Hollowing

stealthprivilege escalation

T1056.001

References

https://attack.mitre.org/software/S0662 https://www.secureworks.com/research/bronze-president-targets-ngos https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf