S0637Windows

S0637NativeZone

Platforms
1
ATT&CK
14.1
References
3

Description

[NativeZone](https://attack.mitre.org/software/S0637) is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/software/S0154) loaders used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)

Platforms· 1

Windows

Attributed to1

TypeTargetConfidenceTier
GroupAPT29g0016100%live

References

  1. https://attack.mitre.org/software/S0637
  2. https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/
  3. https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Software
VaporRage
Software
CozyCar
Software
EnvyScout
Software
BoomBox
Software
BLUELIGHT
Software
CORESHELL
Sourced from MITRE ATT&CK Enterprise 14.1. Curated by Adam Lundqvist, SQUR.