Skip to content

admin@338

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.

ATT&CK ID: G0018
Origin: China
Techniques: 12
Tools: 7

Vulnerabilities it has exploited

CVE-2012-0158 Microsoft MSCOMCTL.OCXUnscored · exploited in the wild

Techniques

Initial Access

Execution

Command and Scripting Interpreter Exploitation for Client Execution User Execution

Stealth

Discovery

System Service Discovery System Network Configuration Discovery System Network Connections Discovery Permission Groups Discovery System Information Discovery File and Directory Discovery Account Discovery

Software

BUBBLEWRAP · LOWBALL · Net · PoisonIvy · Systeminfo · ipconfig · netstat

MITRE ATT&CK All threat actors