216.73.217.22

CozyLarch, UTA0304, UTA0307

· Published 21/12/2025 12:17 · Modified 21/12/2025 12:17 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 12:17
Modified
21/12/2025 12:17
Updated at
21/12/2025 12:17
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 12 attack patterns (mitre), 3 sectors, 2 countries, 7 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (12)

  • T1530 uses
    Data from Cloud Storage
  • T1586 uses
    Compromise Accounts
  • T1528 uses
    Steal Application Access Token
  • T1598 uses
    Phishing for Information
  • T1078 uses
    Valid Accounts
  • T1534 uses
    Internal Spearphishing
  • T1566 uses
    Phishing
  • T1584 uses
    Compromise Infrastructure
  • T1204 uses
    User Execution
  • T1539 uses
    Steal Web Session Cookie
  • T1589 uses
    Gather Victim Identity Information
  • T1550 uses
    Use Alternate Authentication Material

Sectors (3)

  • Government targets
  • Research targets
  • Defense targets

Countries (2)

  • Ukraine targets
  • United States of America targets

Indicators (7)

  • udc30soft.co indicates
  • chromeelevationservice.com indicates
  • androidstatics.com indicates
  • afpi-sec.com indicates
  • comms-net.com indicates
  • rosejob.com indicates
  • sen-comms.com indicates