ThreatNeedle
- ID
- S0665
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 11 Apr 2024
ThreatNeedle is a backdoor that has been used by Lazarus Group since at least 2019 to target cryptocurrency, defense, and mobile gaming organizations. It is considered to be an advanced cluster of Lazarus Group's Manuscrypt (a.k.a. NukeSped) malware family.[1]
Techniques used (14)
- T1005 Data from Local System
- T1027.011 Fileless Storage
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 Malicious File
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1566.001 Spearphishing Attachment