ctrlINT What the industry said about every indicator, with the quote

REF5961Threat actor

Elastic's security team has published a report on REF5961, a cyber-espionage group they found on the network of a Foreign Affairs Ministry from a member of the Association of Southeast Asian Nations (ASEAN). Elastic says it found the group's tools next to the malware of another cyber-espionage group it tracks as REF2924. REF5961's arsenal includes malware such as EAGERBEE, RUDEBIRD, and DOWNTOWN.From MISP Galaxy

Last reported 3 years ago, by Elastic Security Labs2 reports

ATT&CK techniques

6 of 7 · each with the sentence it comes from
  1. T1055Process Injection

    “Shortly after being executed, Elastic Defend registered a process injection alert.”

    Elastic Security LabsVendor
  2. T1005Data from Local System

    “Data from Local System”

    Elastic Security LabsVendor
  3. T1027Obfuscated Files or Information

    “Obfuscated Files or Information”

    Elastic Security LabsVendor
  4. T1041Exfiltration Over C2 Channel

    “Exfiltration Over C2 Channel”

    Elastic Security LabsVendor
  5. T1053.005Scheduled Task

    “As a scheduled task”

    Elastic Security LabsVendor
  6. T1059Command and Scripting Interpreter

    “Command and Scripting Interpreter”

    Elastic Security LabsVendor

What the reports say

2 reports, newest first · the exact sentence from each

  1. “It was discovered in our analysis and is part of the REF5961 intrusion set, which you can read about here.”

    Elastic Security LabsVendor
    Disclosing the BLOODALCHEMY backdoor

  2. “Introducing the REF5961 intrusion set”

    Elastic Security LabsVendor
    Introducing the REF5961 intrusion set

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with REF5961 here?
No account needed. We do not store your IP address.