UTA0178

While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting. Once UTA0178 had access into the network via the ICS VPN appliance, their general approach was to pivot from system… Fuente: MISP

País atribuido: CN según MISP

Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy y SigmaHQ.