Cyber threats

ATT&CK Techniques against Hong Kong

Techniques used by the threat actors that target Hong Kong, by tactic · MITRE ATT&CK profiles · darker = more actors
10
Actors with a profile
82
Techniques
T1204
Most used · 8 actors
Reset
Reconnaissance4
T1589 Gather Victim Identity Information2 T1595 Active Scanning2 T1591 Gather Victim Org Information1 T1598 Phishing for Information1
Resource Development7
T1583 Acquire Infrastructure4 T1587 Develop Capabilities4 T1584 Compromise Infrastructure3 T1588 Obtain Capabilities3 T1585 Establish Accounts2 T1608 Stage Capabilities2 T1586 Compromise Accounts1
Initial Access7
T1566 Phishing6 T1189 Drive-by Compromise4 T1078 Valid Accounts2 T1190 Exploit Public-Facing Application2 T1195 Supply Chain Compromise2 T1091 Replication Through Removable Media1 T1133 External Remote Services1
Execution9
T1204 User Execution8 T1059 Command and Scripting Interpreter5 T1203 Exploitation for Client Execution5 T1053 Scheduled Task/Job4 T1047 Windows Management Instrumentation3 T1574 Hijack Execution Flow3 T1197 BITS Jobs1 T1559 Inter-Process Communication1 T1569 System Services1
Persistence11
T1053 Scheduled Task/Job4 T1547 Boot or Logon Autostart Execution4 T1543 Create or Modify System Process3 T1078 Valid Accounts2 T1098 Account Manipulation2 T1112 Modify Registry2 T1136 Create Account2 T1546 Event Triggered Execution2 T1133 External Remote Services1 T1197 BITS Jobs1 T1505 Server Software Component1
Privilege Escalation9
T1053 Scheduled Task/Job4 T1547 Boot or Logon Autostart Execution4 T1543 Create or Modify System Process3 T1078 Valid Accounts2 T1098 Account Manipulation2 T1546 Event Triggered Execution2 T1055 Process Injection1 T1134 Access Token Manipulation1 T1548 Abuse Elevation Control Mechanism1
Stealth12
T1027 Obfuscated Files or Information6 T1036 Masquerading5 T1218 System Binary Proxy Execution4 T1140 Deobfuscate/Decode Files or Information3 T1574 Hijack Execution Flow3 T1078 Valid Accounts2 T1014 Rootkit1 T1055 Process Injection1 T1070 Indicator Removal1 T1134 Access Token Manipulation1 T1197 BITS Jobs1 T1564 Hide Artifacts1
Defense Impairment2
T1553 Subvert Trust Controls3 T1112 Modify Registry2
Credential Access6
T1003 OS Credential Dumping5 T1056 Input Capture1 T1110 Brute Force1 T1539 Steal Web Session Cookie1 T1552 Unsecured Credentials1 T1555 Credentials from Password Stores1
Discovery14
T1016 System Network Configuration Discovery5 T1083 File and Directory Discovery5 T1049 System Network Connections Discovery4 T1082 System Information Discovery4 T1018 Remote System Discovery3 T1033 System Owner/User Discovery3 T1057 Process Discovery3 T1087 Account Discovery3 T1007 System Service Discovery2 T1012 Query Registry2 T1069 Permission Groups Discovery2 T1482 Domain Trust Discovery2 T1046 Network Service Discovery1 T1217 Browser Information Discovery1
Lateral Movement5
T1021 Remote Services2 T1091 Replication Through Removable Media1 T1210 Exploitation of Remote Services1 T1534 Internal Spearphishing1 T1570 Lateral Tool Transfer1
Collection4
T1560 Archive Collected Data4 T1074 Data Staged3 T1005 Data from Local System1 T1056 Input Capture1
Command and Control7
T1105 Ingress Tool Transfer6 T1090 Proxy4 T1071 Application Layer Protocol2 T1095 Non-Application Layer Protocol1 T1102 Web Service1 T1104 Multi-Stage Channels1 T1572 Protocol Tunneling1
Exfiltration2
T1041 Exfiltration Over C2 Channel2 T1567 Exfiltration Over Web Service2
Impact1
T1486 Data Encrypted for Impact1
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1204 User Execution execution 8 Earth LuscaLazarus GroupBRONZE HIGHLANDAoqin DragonBeijing Group
T1027 Obfuscated Files or Information stealth 6 Earth LuscaLazarus GroupAoqin DragonBeijing GroupAPT40
T1105 Ingress Tool Transfer command-and-control 6 APT41Lazarus GroupBRONZE HIGHLANDBeijing GroupAPT40
T1566 Phishing initial-access 6 Earth LuscaLazarus GroupBeijing GroupAPT40APT3
T1003 OS Credential Dumping credential-access 5 Earth LuscaLazarus GroupBRONZE HIGHLANDAPT40APT3
T1016 System Network Configuration Discovery discovery 5 Earth LuscaLazarus GroupLOTUS PANDAAPT3TEMPER PANDA
T1036 Masquerading stealth 5 Earth LuscaBRONZE HIGHLANDAoqin DragonAPT3TEMPER PANDA
T1059 Command and Scripting Interpreter execution 5 Earth LuscaBRONZE HIGHLANDAPT40APT3TEMPER PANDA
T1083 File and Directory Discovery discovery 5 APT41LOTUS PANDAAoqin DragonAPT3TEMPER PANDA
T1203 Exploitation for Client Execution execution 5 Aoqin DragonBeijing GroupAPT40APT3TEMPER PANDA
T1049 System Network Connections Discovery discovery 4 Earth LuscaLOTUS PANDAAPT3TEMPER PANDA
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 4 Earth LuscaLazarus GroupBRONZE HIGHLANDAPT3

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (10), so the map shows documented tradecraft, not everything that happens.