Anchor
- ID
- S0504
- Type
- Malware
- Associated names
- Anchor_DNS
- Platforms
- Linux, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 5 Dec 2023
Anchor is one of a family of backdoor malware that has been used in conjunction with TrickBot on selected high profile targets since at least 2018.[1][2]
Techniques used (20)
- T1008 Fallback Channels
- T1016 System Network Configuration Discovery
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1071.004 DNS
- T1082 System Information Discovery
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1480 Execution Guardrails
- T1543.003 Windows Service
- T1553.002 Code Signing
- T1564.004 NTFS File Attributes
- T1569.002 Service Execution