| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1572 ↗ | Protocol Tunneling | command and control | Article describes FOXSHELL's proxy behavior (opening a new socket to a remote machine specified in its configuration, or relaying Data-type packages) as tunneling arbitrary service traffic through the web shell's HTTP channel. |
| T1090 ↗ | Proxy | command and control | Article describes FOXSHELL (based on the open-source Tunna tunnel framework) as allowing connection from outside to any service on the remote host, including firewall-blocked services, by proxying all external communication through the web shell over HTTP. |
| T1095 ↗ | Non-Application Layer Protocol | command and control | Article describes a named-pipe variant of LIONTAIL that uses named pipes (not HTTP) to facilitate remote code execution, with a security descriptor granting File All Access to everyone. |
| T1071.001 ↗ | Application Layer Protocol: Web Protocols | command and control | LIONTAIL's primary variant is described as a passive backdoor on Windows servers that enables attackers to execute commands remotely through HTTP requests, listening on URL prefixes mimicking legitimate services (e.g. /autodiscover/autodiscovers/, /ews/exchanges/). |
| T1105 ↗ | Ingress Tool Transfer | command and control | Article describes the SDD backdoor's Rundll command type, which loads additional .NET assemblies delivered by the operators, and generally describes downloading/staging of additional tooling to compromised servers. |
| T1014 ↗ | Rootkit | defense evasion | Article describes WINTAPIX as a kernel-mode driver used to enumerate user-mode processes and inject shellcode from kernel level, consistent with kernel-mode rootkit-enabling functionality. |
+16 more relationships — see the relationships browser.
| T1562.002 ↗ | Impair Defenses: Disable Windows Event Logging | defense evasion | Article states FOXSHELL version 1.7 includes an Event Log bypass using a known technique of suspending EventLog Service threads. |
| T1027.002 ↗ | Obfuscated Files or Information: Software Packing | defense evasion | Article describes web shell variants (e.g. the compiled-DLL FOXSHELL) with class and method obfuscation, and payload/URL generation that inserts random dictionary words into paths so malware communication blends into legitimate traffic. |
| T1036.005 ↗ | Masquerading: Match Legitimate Resource Name or Location | defense evasion | Article states implants attempt to disguise the executable as Cyvera Console, a component of Cortex XDR. |
| T1027.013 ↗ | Obfuscated Files or Information: Encrypted/Encoded File | defense evasion | Article describes payloads that are base64-decoded and then decrypted by XORing the data with the first byte (or a randomly chosen prepended key byte for responses); web shell variants use the same XOR/base64 scheme with additional class/method/string obfuscation. |
| T1518 ↗ | Software Discovery | discovery | Article describes the SDD backdoor using the .NET ServerManager class to extract the list of sites hosted by IIS in order to build a matching set of URL prefixes to listen on. |
| T1082 ↗ | System Information Discovery | discovery | Article describes a machine-fingerprinting payload gathering Computer Name, Domain Name, 64-bit flag, number of processors, physical RAM, and data from CurrentVersion, SecureBoot\State, and System\Bios registry keys. |
| T1055 ↗ | Process Injection | execution | Article describes LIONTAIL creating a new thread and running received shellcode in memory, and separately describes the WINTAPIX kernel driver injecting Donut-generated shellcode into a found user-mode process running with local system privileges. |
| T1059.003 ↗ | Command and Scripting Interpreter: Windows Command Shell | execution | Article describes the SDD backdoor executing base64-decoded commands via cmd /c when it receives a POST request containing a specific trigger string. |
| T1041 ↗ | Exfiltration Over C2 Channel | exfiltration | Article describes the SDD backdoor's Download command sending a specified file to the threat actors over the same C2 channel, and references historical email exfiltration from Exchange/EWS access across Kuwait, Saudi Arabia, Turkey, UAE, and Jordan. |
| T1190 ↗ | Exploit Public-Facing Application | initial access | Check Point reporting ties Scarred Manticore's Albania intrusion to exploitation of an Internet-facing Microsoft SharePoint server; article also generally references exploitation of publicly facing servers as an access vector. |
| T1090.002 ↗ | Proxy: External Proxy | lateral movement, exfiltration | Article describes the LIONHEAD web forwarder deployed on Exchange servers, which forwards request content type, cookie, and body to a configured forward_server/forward_path/forward_port, used to reach Exchange Web Services (EWS) endpoints while concealing the true external consumer of the data. |
| T1543.003 ↗ | Create or Modify System Process: Windows Service | persistence | Article describes enabling specific Windows services (e.g. IKE and AuthIP IPsec Keying Modules, Extensible Authentication Protocol) via commands like sc.exe config Eaphost start=auto to trigger the hijacked DLL's loading at boot. |
| T1505.003 ↗ | Server Software Component: Web Shell | persistence | Article details a lineage of web shells (Tunna-based, FOXSHELL versions XORO/Bsae64/compiled-DLL, an XSL transform web shell, and an SDD .NET web-based backdoor) deployed on compromised servers for persistent access. |
| T1574.001 ↗ | Hijack Execution Flow: DLL Search Order Hijacking | persistence, privilege escalation | Article describes malicious DLLs dropped to C:\windows\system32 using names not present by default on Windows Server (e.g. wlanapi.dll, wlbsctrl.dll) to be side-loaded by legitimate services. |
Malware and tools this actor is known to use. ATT&CK-attributed rows are MITRE's own software↔group relationships; curated rows fill the gap for MENA actors ATT&CK doesn't track — treat those as analyst assessment, not authoritative attribution.
content/actor-software-mapping.csv — cti-expert-curated, for actors or tools ATT&CK hasn't catalogued yet.Regional co-occurrence is association, not prediction. These techniques appeared alongside Scarred Manticore (Storm-0861)'s activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.
Which Microsoft 365 controls protect, detect, or respond to this actor's techniques — from the CTID Mappings Explorer (technique-level). Strength: significant / partial / minimal.
Defensive techniques that counter Scarred Manticore (Storm-0861)'s TTPs, from MITRE D3FEND. The ATT&CK↔D3FEND link is mitigation-mediated — treat these as candidate countermeasures, not prescriptions.