Confucius
Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.
- ATT&CK ID
- G0142
- Techniques
- 16
- Tools
- 1
Also tracked as Confucius APT
Vulnerabilities it has exploited
- CVE-2015-1641 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0802 Microsoft OfficeUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Execution
Scheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser Execution
Persistence
Scheduled Task/JobBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart Execution
Stealth
System Binary Proxy ExecutionTemplate Injection
Discovery
File and Directory DiscoveryLocal Storage Discovery
Collection
Command and Control
Application Layer ProtocolIngress Tool Transfer
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Software
WarzoneRAT