Native API T1106
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by…
- Tactics
- Execution
- Actors using it
- 21
- Sub-techniques
- 0
Ransomware groups reported using it
Threat actors
- KimsukyNorth Korea · Black Banshee, Velvet Chollima, Emerald Sleet · 87 techniques
- APT38North Korea · NICKEL GLADSTONE, BeagleBoyz, Bluenoroff · 70 techniques
- Lazarus GroupNorth Korea · Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace · 69 techniques
- Sandworm TeamRussia · ELECTRUM, Telebots, IRON VIKING · 64 techniques
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- Gamaredon GroupRussia · IRON TILDEN, Primitive Bear, ACTINIUM · 55 techniques
- Medusa Group52 techniques
- TurlaRussia · IRON HUNTER, Group 88, Waterbug · 50 techniques
- ChimeraChina · 49 techniques
- NIMBUS MANTICOREUNC1549, TA455, COBALT SMOKEY · 45 techniques
- menuPassChina · Cicada, POTASSIUM, Stone Panda · 37 techniques
- Tropic TrooperPirate Panda, KeyBoy · 35 techniques
- APT37North Korea · InkySquid, ScarCruft, Reaper · 25 techniques
- SilenceWhisper Spider · 25 techniques
- HigaisaSouth Korea · 24 techniques
- TA505Hive0065, Spandex Tempest, CHIMBORAZO · 24 techniques
- ToddyCat24 techniques
- WIRTEAshen Lepus · 21 techniques
- SideCopyPakistan · 15 techniques
- Gorgon GroupPakistan · 12 techniques
- BlackTechChina · Palmerworm · 10 techniques