Thrip

Introduction

Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as “living off the land” techniques. Symantec Thrip June 2018

Activities and Tactics

Targeted Sectors: Private sector

Country of Origin: 🏳️ Unknown

Risk Level: High

Incident Type: Espionage

Suspected Victims: United States

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1059.001 PowerShell
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1219.002 Remote Desktop Software
• T1588.002 Tool

ATT&CK technique IDs (denormalized)

• T1048.003
• T1059.001
• T1219.002
• T1588.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• UNITEDRAKE

MITRE ATT&CK Software

• PsExec (S0029) — tool
• Mimikatz (S0002) — tool
• Catchamas (S0261) — malware

Attribution and Evidence

Country of Origin: Unknown Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] Symantec Thrip June 2018 Security Response Attack Investigation Team. (2018, June 19). Thrip: Espionage Group Hits Satellite, Telecoms, and Defense Companies. Retrieved July 10, 2018.