Fxmsp

Also known as: ATK 134, ATK134, Fxmsp, TAG-CR17

Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote desktop protocol (RDP) servers and exposed active directory. Most recently, the actor claimed to have developed a credential-stealing botnet capable of infecting high-profile targets in order to exfiltrate sensitive usernames and passwords. Fxmsp has claimed that developing this botnet and improving its capabilities for stealing information from secured systems is their main goal.

🌍 Country ["Kazakhstan"]

Associated Operations

2019-05 Breaches of Three Major Anti-Virus Companies https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Introduction

Throughout 2017 and 2018, Fxmsp established a network of trusted proxy resellers to promote their breaches on the criminal underground. Some of the known Fxmsp TTPs included accessing network environments via externally available remote desktop protocol (RDP) servers and exposed active directory. Most recently, the actor claimed to have developed a credential-stealing botnet capable of infecting high-profile targets in order to exfiltrate sensitive usernames and passwords. Fxmsp has claimed that developing this botnet and improving its capabilities for stealing information from secured systems is their main goal.

Activities and Tactics

Country of Origin: 🏳️ [“Kazakhstan”]

Notable Campaigns

  • 2019-05
  • Breaches of Three Major Anti-Virus Companies
  • https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Net Crawler
  • RemoteCMD
  • Remote Utilities
  • RemotePC
  • DesktopNow
  • RDP:
  • exposed AD:

Attribution and Evidence

Country of Origin: [“Kazakhstan”] Additional attribution information pending cataloguing.

References

References pending cataloguing.