Appendix A: MITRE ATT&CK tactics and techniques

See Table 9 through Table 19 for all the threat actor tactics and techniques referenced in this advisory. Table 9: Reconnaissance Technique Title ID Use Gather Victim Identity Information: Credentials T1589. 001 The payload attempts to intercept a victim’s password from their password manager. Gather Victim Identity Information: Email Addresses T1589. 002 The payload attempts to grab the victim’s email address from various data stores.

Search Open Websites/Domains T1593 This group likely leverages public information to support target development. Active Scanning T1595 Port scanning can be used by this group to assist with determining exploitability of identified targets. Search Open Technical Databases: Scan Databases T1596. 005 Various public datasets can provide information to support discovery of exploitable targets. Search Closed Sources T1597 Previously exfiltrated data can be used to enhance target development efforts.

Search Closed Sources: Purchase Technical Data T1597. 002 Commercial datasets can also be used to support target development efforts. Table 10: Resource Development Technique Title ID Use Acquire Infrastructure T1583 This group used Mullvad VPN to anonymize traffic sent to operational infrastructure. Acquire Infrastructure: Virtual Private Server T1583. 003 This group procured VPS servers from a variety of vendors.

Develop Capabilities T1587 The Ulej capability was developed likely for use by this group to conduct spear phishing campaigns. Develop Capabilities: Malware T1587. 001 Development of a novel payload that steals a victim’s emails and other sensitive account information. Develop Capabilities: Exploits T1587.