Agent.BTZMalware
- ComRAT
- minit
- sun rootkit
Agent.btz is a worm that primarily spreads itself via removable devices such as USB drives. It reportedly infected U. S. military networks in 2008.From MITRE ATT&CK
Last reported 9 days ago, by The Register (security)2 reports
ATT&CK techniques
6 of 12 · each with the sentence it comes from- T1070Indicator Removal
“In regards to threats, often adversaries will attempt indicator removal (T1070) by clearing audit logs to remove any potential footprints, however, GW audit logs are managed by Google and have retention policies only.”
- T1078.004Cloud Accounts
“While the admin console is not inherently a risk, compromised valid accounts (T1078.004) with that level of privilege expose organizations to greater risk.”
- T1098.003Additional Cloud Roles
“…expectedly be bypassed by users outside their expected access groups, thus introducing insider threat risk via additional cloud roles (T1098.003).”
- T1102Web Service
“Taking Gmail a step further, adversaries may also use GW’s web services (T1102) for command and control purposes as identified by ESET researchers regarding the ComRAT v4 backdoor of 2020.”
- T1102.002Bidirectional Communication
“Command and control via bidirectional communication (T1102.002) to a Google Drive is another option for adversaries who may be using the service to host and deploy malicious payloads as those from APT29.”
- T1114Email Collection
“Email collection (T1114) is another technique used by adversaries whose modus operandi (MO), may be to simply collect sensitive information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
US Air Force pilots used malware-laden USB drives to plan Afghanistan missions“The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers.”
-
Google Workspace Attack Surface“…her, adversaries may also use GW’s web services (T1102) for command and control purposes as identified by ESET researchers regarding the ComRAT v4 backdoor of 2020.”
Indicators in its reports
named in the reports above- sitpub[.]comin 1 report
Copy this indicator · defanged
Thanks — we review every report.