UTA0178

While Volexity largely observed the attacker essentially living off the land, they still deployed a handful of malware files and tools during the course of the incident which primarily consisted of webshells, proxy utilities, and file modifications to allow credential harvesting. Once UTA0178 had access into the network via the ICS VPN appliance, their general approach was to pivot from system… Source: MISP

Attributed country: CN according to MISP

Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy and SigmaHQ.