Cyber threats

ATT&CK Techniques against Vietnam

Techniques used by the threat actors that target Vietnam, by tactic · MITRE ATT&CK profiles · darker = more actors
9
Actors with a profile
87
Techniques
T1204
Most used · 7 actors
Reset
Reconnaissance3
T1589 Gather Victim Identity Information1 T1595 Active Scanning1 T1598 Phishing for Information1
Resource Development6
T1588 Obtain Capabilities5 T1583 Acquire Infrastructure2 T1608 Stage Capabilities2 T1584 Compromise Infrastructure1 T1585 Establish Accounts1 T1587 Develop Capabilities1
Initial Access5
T1566 Phishing7 T1078 Valid Accounts3 T1189 Drive-by Compromise3 T1190 Exploit Public-Facing Application2 T1091 Replication Through Removable Media1
Execution10
T1204 User Execution7 T1047 Windows Management Instrumentation5 T1053 Scheduled Task/Job5 T1059 Command and Scripting Interpreter5 T1203 Exploitation for Client Execution4 T1574 Hijack Execution Flow3 T1106 Native API2 T1072 Software Deployment Tools1 T1559 Inter-Process Communication1 T1569 System Services1
Persistence8
T1053 Scheduled Task/Job5 T1547 Boot or Logon Autostart Execution5 T1078 Valid Accounts3 T1112 Modify Registry3 T1543 Create or Modify System Process3 T1137 Office Application Startup2 T1098 Account Manipulation1 T1505 Server Software Component1
Privilege Escalation9
T1053 Scheduled Task/Job5 T1547 Boot or Logon Autostart Execution5 T1078 Valid Accounts3 T1543 Create or Modify System Process3 T1055 Process Injection2 T1548 Abuse Elevation Control Mechanism2 T1068 Exploitation for Privilege Escalation1 T1098 Account Manipulation1 T1134 Access Token Manipulation1
Stealth12
T1036 Masquerading6 T1027 Obfuscated Files or Information5 T1078 Valid Accounts3 T1218 System Binary Proxy Execution3 T1574 Hijack Execution Flow3 T1055 Process Injection2 T1564 Hide Artifacts2 T1070 Indicator Removal1 T1134 Access Token Manipulation1 T1140 Deobfuscate/Decode Files or Information1 T1216 System Script Proxy Execution1 T1221 Template Injection1
Defense Impairment4
T1112 Modify Registry3 T1222 File and Directory Permissions Modification1 T1685 Disable or Modify Tools1 T1686 Disable or Modify System Firewall1
Credential Access5
T1003 OS Credential Dumping2 T1555 Credentials from Password Stores2 T1056 Input Capture1 T1539 Steal Web Session Cookie1 T1552 Unsecured Credentials1
Discovery17
T1018 Remote System Discovery5 T1083 File and Directory Discovery5 T1016 System Network Configuration Discovery4 T1049 System Network Connections Discovery4 T1057 Process Discovery4 T1033 System Owner/User Discovery3 T1046 Network Service Discovery3 T1082 System Information Discovery3 T1087 Account Discovery3 T1518 Software Discovery3 T1012 Query Registry2 T1069 Permission Groups Discovery2 T1482 Domain Trust Discovery2 T1007 System Service Discovery1 T1120 Peripheral Device Discovery1 T1135 Network Share Discovery1 T1680 Local Storage Discovery1
Lateral Movement6
T1021 Remote Services2 T1570 Lateral Tool Transfer2 T1072 Software Deployment Tools1 T1091 Replication Through Removable Media1 T1210 Exploitation of Remote Services1 T1550 Use Alternate Authentication Material1
Collection5
T1560 Archive Collected Data4 T1005 Data from Local System3 T1074 Data Staged2 T1056 Input Capture1 T1123 Audio Capture1
Command and Control7
T1071 Application Layer Protocol3 T1090 Proxy3 T1102 Web Service3 T1105 Ingress Tool Transfer2 T1095 Non-Application Layer Protocol1 T1571 Non-Standard Port1 T1573 Encrypted Channel1
Exfiltration3
T1567 Exfiltration Over Web Service2 T1041 Exfiltration Over C2 Channel1 T1048 Exfiltration Over Alternative Protocol1
Impact2
T1529 System Shutdown/Reboot1 T1561 Disk Wipe1
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1204 User Execution execution 7 NaikonEarth LuscaAoqin DragonAPT30APT32
T1566 Phishing initial-access 7 NaikonEarth LuscaToddyCatAPT30APT32
T1036 Masquerading stealth 6 NaikonEarth LuscaToddyCatAoqin DragonAPT32
T1018 Remote System Discovery discovery 5 NaikonEarth LuscaToddyCatLOTUS PANDAAPT32
T1027 Obfuscated Files or Information stealth 5 Earth LuscaAoqin DragonAPT32APT37Inception Framework
T1047 Windows Management Instrumentation execution 5 NaikonEarth LuscaToddyCatLOTUS PANDAAPT32
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 5 NaikonEarth LuscaToddyCatAPT32APT37
T1059 Command and Scripting Interpreter execution 5 Earth LuscaToddyCatAPT32APT37Inception Framework
T1083 File and Directory Discovery discovery 5 ToddyCatLOTUS PANDAAoqin DragonAPT32Inception Framework
T1547 Boot or Logon Autostart Execution persistence, privilege-escalation 5 NaikonEarth LuscaAPT32APT37Inception Framework
T1588 Obtain Capabilities resource-development 5 Earth LuscaLOTUS PANDAAoqin DragonAPT32Inception Framework
T1016 System Network Configuration Discovery discovery 4 NaikonEarth LuscaLOTUS PANDAAPT32

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (9), so the map shows documented tradecraft, not everything that happens.