BackdoorDiplomacy (G0135) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

CISA Known Exploited

About BackdoorDiplomacy

BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.

View MITRE record ↗

Techniques by Tactic (15)

Resource Development

T1588.001 MalwareT1588.002 Tool

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1574.001 DLL

Persistence

T1505.003 Web Shell

Privilege Escalation

T1055.001 Dynamic-link Library Injection

Stealth

T1027 Obfuscated Files or InformationT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1055.001 Dynamic-link Library InjectionT1574.001 DLL

Discovery

T1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1120 Peripheral Device Discovery

Collection

T1074.001 Local Data Staging

Command & Control

T1095 Non-Application Layer ProtocolT1105 Ingress Tool Transfer

Toolsets (5)

🐛

China Chopper S0020

Malware · Windows

🐛

Turian S0647

Malware · Windows, Linux

🔧

Mimikatz S0002

Tool · Windows

🔧

NBTscan S0590

Tool · Windows, Linux, macOS

🔧

QuasarRAT S0262

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (1)

Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021

↑