Pulse Detail — Threat Intelligence

PULSE NAME

APT31 renews its attacks on Russian companies through cloud storage

WHITE APT31 AlienVault 2022-08-12 Modified: 2022-08-12

IOCs

HIGH VOLUME

A guide to the latest developments in the fight against cyber-thieves APT31, who are believed to be targeting Russian companies through cloud storage, as well as providing security services for the energy sector.

APT31 Cloud

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1204 T1566 T1587.001 T1587.002 T1547.001 T1574 T1140 T1036 T1112 T1027 T1560 T1001 T1095 T1573.001 T1132.001 T1132.002 T1102 T1020 T1041

MALWARE FAMILIES

YaRAT

Indicators of Compromise (15 / 55 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA1	144493b13df06bab3f290b260b997b71164a25f7	—	2022-08-12
FileHash-SHA1	3785d9c4bdf6812f753d93b70781d3db68141ce7	—	2022-08-12
FileHash-SHA1	49307f1091251dd7a498cf69d0465ddd59859cf8	—	2022-08-12
FileHash-SHA1	52999153cc7d3a3771a8ee9b8e55f913829109a7	—	2022-08-12
FileHash-SHA1	584fd63ab925c532cf40818886487714b3de317e	—	2022-08-12
FileHash-SHA1	97e19f67a8d6af78c181f05198aa7d200b243ea5	—	2022-08-12
FileHash-SHA1	af33573bc8e507875acdb3db52bcfea13bb1286e	—	2022-08-12
FileHash-SHA1	c694e99f8690114c77a6099856d61a3cd4cd814d	—	2022-08-12
FileHash-SHA1	d1cc0f861f162dfbf9df1493fe861d02b80483f6	—	2022-08-12
FileHash-SHA1	d25a68289fc1268d7c548787373a6235895716fb	—	2022-08-12
FileHash-SHA1	d91ffc6d48f79e0b55918fb73365b9fca37c9efa	—	2022-08-12
FileHash-SHA1	ef0f61c32a3ae2494000f36a700a151c8b10c134	—	2022-08-12
FileHash-SHA1	f3c600ba1d1d0cb1f3383805dbcac19e9423bdcb	—	2022-08-12
FileHash-SHA1	fd05e69d1f094b3a28bb5ae2a936607aa0db3866	—	2022-08-12
FileHash-SHA1	ff5e78218198dd5ca5dc2eb46ec8afdd1b6260e9	—	2022-08-12

References (1)

↗ https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/apt31-cloud-attacks/