Introduction
Suckfly is a China-based threat group that has been active since at least 2014. Symantec Suckfly March 2016
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1059.003 Windows Command Shell
- T1078 Valid Accounts
- T1046 Network Service Discovery
- T1003 OS Credential Dumping
- T1553.002 Code Signing
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [3] Symantec Suckfly March 2016 DiMaggio, J. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016. [4] Symantec Suckfly May 2016 DiMaggio, J. (2016, May 17). Indian organizations targeted in Suckfly attacks. Retrieved August 3, 2016.