Cyber threats

ATT&CK Techniques against Cambodia

Techniques used by the threat actors that target Cambodia, by tactic · MITRE ATT&CK profiles · darker = more actors
4
Actors with a profile
50
Techniques
T1204
Most used · 4 actors
Reset
Reconnaissance2
T1589 Gather Victim Identity Information1 T1595 Active Scanning1
Resource Development6
T1587 Develop Capabilities2 T1583 Acquire Infrastructure1 T1584 Compromise Infrastructure1 T1585 Establish Accounts1 T1586 Compromise Accounts1 T1588 Obtain Capabilities1
Initial Access6
T1566 Phishing3 T1078 Valid Accounts2 T1091 Replication Through Removable Media1 T1133 External Remote Services1 T1189 Drive-by Compromise1 T1190 Exploit Public-Facing Application1
Execution8
T1204 User Execution4 T1047 Windows Management Instrumentation2 T1053 Scheduled Task/Job2 T1059 Command and Scripting Interpreter2 T1203 Exploitation for Client Execution2 T1197 BITS Jobs1 T1559 Inter-Process Communication1 T1574 Hijack Execution Flow1
Persistence8
T1053 Scheduled Task/Job2 T1078 Valid Accounts2 T1546 Event Triggered Execution2 T1547 Boot or Logon Autostart Execution2 T1133 External Remote Services1 T1137 Office Application Startup1 T1197 BITS Jobs1 T1505 Server Software Component1
Privilege Escalation5
T1053 Scheduled Task/Job2 T1078 Valid Accounts2 T1546 Event Triggered Execution2 T1547 Boot or Logon Autostart Execution2 T1055 Process Injection1
Stealth8
T1027 Obfuscated Files or Information2 T1036 Masquerading2 T1078 Valid Accounts2 T1218 System Binary Proxy Execution2 T1055 Process Injection1 T1140 Deobfuscate/Decode Files or Information1 T1197 BITS Jobs1 T1574 Hijack Execution Flow1
Defense Impairment1
T1553 Subvert Trust Controls1
Credential Access1
T1003 OS Credential Dumping1
Discovery5
T1016 System Network Configuration Discovery1 T1018 Remote System Discovery1 T1046 Network Service Discovery1 T1083 File and Directory Discovery1 T1518 Software Discovery1
Lateral Movement4
T1021 Remote Services1 T1091 Replication Through Removable Media1 T1534 Internal Spearphishing1 T1570 Lateral Tool Transfer1
Collection2
T1074 Data Staged1 T1560 Archive Collected Data1
Command and Control5
T1105 Ingress Tool Transfer2 T1071 Application Layer Protocol1 T1090 Proxy1 T1102 Web Service1 T1572 Protocol Tunneling1
Exfiltration2
T1041 Exfiltration Over C2 Channel1 T1567 Exfiltration Over Web Service1
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1204 User Execution execution 4 NaikonAoqin DragonAPT40RANCOR
T1566 Phishing initial-access 3 NaikonAPT40RANCOR
T1027 Obfuscated Files or Information stealth 2 Aoqin DragonAPT40
T1036 Masquerading stealth 2 NaikonAoqin Dragon
T1047 Windows Management Instrumentation execution 2 NaikonAPT40
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 2 NaikonRANCOR
T1059 Command and Scripting Interpreter execution 2 APT40RANCOR
T1078 Valid Accounts stealth, persistence, privilege-escalation, initial-access 2 NaikonAPT40
T1105 Ingress Tool Transfer command-and-control 2 APT40RANCOR
T1203 Exploitation for Client Execution execution 2 Aoqin DragonAPT40
T1218 System Binary Proxy Execution stealth 2 APT40RANCOR
T1546 Event Triggered Execution privilege-escalation, persistence 2 APT40RANCOR

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (4), so the map shows documented tradecraft, not everything that happens.