Cyber threats

ATT&CK Techniques against Myanmar

Techniques used by the threat actors that target Myanmar, by tactic · MITRE ATT&CK profiles · darker = more actors
3
Actors with a profile
20
Techniques
T1204
Most used · 2 actors
Reset
Reconnaissance0
—
Resource Development1
T1583 Acquire Infrastructure1
Initial Access2
T1566 Phishing2 T1078 Valid Accounts1
Execution4
T1204 User Execution2 T1047 Windows Management Instrumentation1 T1053 Scheduled Task/Job1 T1574 Hijack Execution Flow1
Persistence4
T1053 Scheduled Task/Job1 T1078 Valid Accounts1 T1137 Office Application Startup1 T1547 Boot or Logon Autostart Execution1
Privilege Escalation3
T1053 Scheduled Task/Job1 T1078 Valid Accounts1 T1547 Boot or Logon Autostart Execution1
Stealth5
T1014 Rootkit1 T1027 Obfuscated Files or Information1 T1036 Masquerading1 T1078 Valid Accounts1 T1574 Hijack Execution Flow1
Defense Impairment1
T1553 Subvert Trust Controls1
Credential Access0
—
Discovery6
T1016 System Network Configuration Discovery1 T1018 Remote System Discovery1 T1046 Network Service Discovery1 T1057 Process Discovery1 T1083 File and Directory Discovery1 T1518 Software Discovery1
Lateral Movement0
—
Collection0
—
Command and Control1
T1105 Ingress Tool Transfer1
Exfiltration0
—
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1204 User Execution execution 2 NaikonMofang
T1566 Phishing initial-access 2 NaikonMofang
T1014 Rootkit stealth 1 APT41
T1016 System Network Configuration Discovery discovery 1 Naikon
T1018 Remote System Discovery discovery 1 Naikon
T1027 Obfuscated Files or Information stealth 1 Mofang
T1036 Masquerading stealth 1 Naikon
T1046 Network Service Discovery discovery 1 Naikon
T1047 Windows Management Instrumentation execution 1 Naikon
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 1 Naikon
T1057 Process Discovery discovery 1 APT41
T1078 Valid Accounts stealth, persistence, privilege-escalation, initial-access 1 Naikon

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (3), so the map shows documented tradecraft, not everything that happens.