SCARLETEELThreat actor
SCARLETEEL is a threat actor that primarily targets cloud environments, specifically AWS and Kubernetes. They have been observed stealing proprietary data and intellectual property, as well as conducting cryptomining operations.From MISP Galaxy
Last reported 22 months ago, by Elastic Security Labs1 report
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1078.004Cloud Accounts
“T1078.004 - Valid Accounts: Cloud Accounts”
- T1098Account Manipulation
“T1098.003 - Account Manipulation: Additional Cloud Roles”
- T1098.003Additional Cloud Roles
“T1098.003 - Additional Cloud Roles”
- T1548Abuse Elevation Control Mechanism
“T1548.005 - Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access”
- T1548.005Temporary Elevated Cloud Access
“T1548.005 - Temporary Elevated Cloud Access”
What the reports say
1 report, newest first · the exact sentence from each-
Exploring AWS STS AssumeRoot“…hile this is a hurdle, the probability of compromised credentials for initial access is high - such as those with SCATTERED SPIDER and SCARLETEEL.”
Indicators in its reports
named in the reports above- outputs[.]tfin 1 report
- main[.]tfin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.