S0360Windows

S0360BONDUPDATER

Platforms
1
ATT&CK
14.1
References
3

Description

[BONDUPDATER](https://attack.mitre.org/software/S0360) is a PowerShell backdoor used by [OilRig](https://attack.mitre.org/groups/G0049). It was first observed in November 2017 during targeting of a Middle Eastern government organization, and an updated version was observed in August 2018 being used to target a government organization with spearphishing emails.(Citation: FireEye APT34 Dec 2017)(Citation: Palo Alto OilRig Sep 2018)

Platforms· 1

Windows

Attributed to1

TypeTargetConfidenceTier
GroupOilRigg0049100%live

References

  1. https://attack.mitre.org/software/S0360
  2. https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html
  3. https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Software
QUADAGENT
Software
RDAT
Software
POWERSOURCE
Software
POWERTON
Software
adbupd
Actor
Bondnet
Sourced from MITRE ATT&CK Enterprise 14.1. Curated by Adam Lundqvist, SQUR.