🖖🏽 📥 🐻 Identify the enemy: how MITER TTPs help identify the attacker 🌓 🍋 ⛔️

The number of ways that hacker groups use to attack companies seems endless, but in reality they are not. Almost all tactics and techniques of cybercriminals have been analyzed and documented in the public MITER ATT & CK database. In this post, we will tell you how, during the investigation of a real incident, using the MITER ATT & CK base helped us figure out which group attacked the client company.

Initial analysis

We were approached by a company, one of the servers in the network of which was constantly exchanging data with a third-party Internet server. After initial examination, it turned out that this traffic contained data and commands that were exchanged between the malware and the attacker's C&C server.