Pandora

Malware & Tools · Pandora

· MalwareS0664 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Windows

Description

Pandora is a multistage kernel rootkit with backdoor functionality that has been in use by Threat Group-3390 since at least 2020.(Citation: Trend Micro Iron Tiger April 2021)

Tactic Coverage

stealth (4)command and control (4)privilege escalation (3)persistence (3)defense impairment (2)execution (2)discovery (1)

Used By (2 groups)

G1021Cinnamon TempestDEV-0401, Emperor Dragonfly G0027Threat Group-3390Earth Smilodon, TG-3390

Techniques (13)

T1027.015Compression

stealth

T1055Process Injection

stealthprivilege escalation

T1057Process Discovery

discovery

T1068Exploitation for Privilege Escalation

privilege escalation

T1071.001Web Protocols

command and control

T1105Ingress Tool Transfer

command and control

References

https://attack.mitre.org/software/S0664 https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html