G0039 Suckfly

Suckfly is a China-based threat group that has been active since at least 2014. ¹

Techniques Used

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	Several tools used by Suckfly have been command-line driven.²
enterprise	T1046	Network Service Discovery	Suckfly the victim’s internal network for hosts with ports 8080, 5900, and 40 open.²
enterprise	T1003	OS Credential Dumping	Suckfly used a signed credential-dumping tool to obtain victim account credentials.²
enterprise	T1553	Subvert Trust Controls	-
enterprise	T1553.002	Code Signing	Suckfly has used stolen certificates to sign its malware.¹
enterprise	T1078	Valid Accounts	Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.²

ID	Name	References	Techniques
S0118	Nidiran	¹²	Windows Service:Create or Modify System Process Ingress Tool Transfer Masquerade Task or Service:Masquerading