Protocol Tunneling T1572
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal…
- Tactics
- Command and Control
- Actors using it
- 15
- Sub-techniques
- 0
Ransomware groups reported using it
Threat actors
- Mustang PandaChina · TA416, RedDelta, BRONZE PRESIDENT · 61 techniques
- OilRigIran · COBALT GYPSY, IRN2, APT34 · 58 techniques
- Magic HoundIran · TA453, COBALT ILLUSION, Charming Kitten · 58 techniques
- VOID MANTICOREIran · COBALT MYSTIQUE, Handala Hack, Homeland Justice · 51 techniques
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Scattered SpiderRoasted 0ktapus, Octo Tempest, Storm-0875 · 50 techniques
- ChimeraChina · 49 techniques
- Salt TyphoonChina · 43 techniques
- FIN13Elephant Beetle · 42 techniques
- Ember BearRussia · UNC2589, Bleeding Bear, DEV-0586 · 39 techniques
- LeviathanChina · MUDCARP, Kryptonite Panda, Gadolinium · 37 techniques
- FIN6Magecart Group 6, ITG08, Skeleton Spider · 33 techniques
- Fox KittenIran · UNC757, Parisite, Pioneer Kitten · 31 techniques
- Cobalt GroupGOLD KINGSWOOD, Cobalt Gang, Cobalt Spider · 26 techniques
- Cinnamon TempestChina · DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT · 16 techniques