Deep Dive into a Corporate Espionage Operation

Bitdefender analyzed a recent industrial espionage operation targeting a small (under 200 employees) technology company based in the United States. The attack was focused on information exfiltration and spans several months. A vast network of several hundred IP addresses (most of them originated from China) was used as part of this attack

REFERENCE: https://businessinsights.bitdefender.com/deep-dive-into-a-corporate-espionage-operation

TAGS: WDIGEST, WMIC, Exfiltration, Mimikatz, ChinaChopper, Webshell, CVE-2021-40539

INDUSTRY: Technology

ATT&CK IDS: T1505 - Server Software Component, T1027 - Obfuscated Files or Information, T1071 - Application Layer Protocol, T1560 - Archive Collected Data, T1135 - Network Share Discovery, T1203 - Exploitation for Client Execution, T1195 - Supply Chain Compromise, T1011 - Exfiltration Over Other Network Medium

Read More:

https://otx.alienvault.com/pulse/6310c8b1ae9f85af2d64d77d