The threat actor has gained initial access and is utilizing various defense evasion techniques to avoid detection while establishing persistence and maintaining control.
Tag: T1564.001
Ursnif Banking Trojan
The Ursnif banking trojan may be present in the environment, utilizing memory injection techniques to evade detection and maintain persistence.
COLDRIVER – SPICA malware
APT group Coldriver uses spearphishing to deliver malware via PDFs as lure documents.