{
  "name": "The Curious Case of an Excellent Resume",
  "slug": "the-curious-case-of-an-excellent-resume",
  "description": "This report details a malicious campaign where the threat actor gained initial access through a resume lure as part of a TA4557/FIN6 operation. The actor employed techniques like abusing legitimate binaries, establishing Cobalt Strike and Pyramid C2, exploiting CVE-2023-27532 for lateral movement, and using Cloudflared for tunneling traffic.",
  "published": "2024-12-04T19:55:51+00:00",
  "created_at": "2024-12-04T19:55:51+00:00",
  "modified_at": "2024-12-04T20:38:50+00:00",
  "created_at_opencti": "2024-12-04T19:55:51+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-12-04",
    "CVE-2023-27532",
    "apt",
    "c2 pyramid",
    "cloudflared",
    "cobalt strike",
    "credentials",
    "lateral movement",
    "more_eggs",
    "persistence",
    "privilege-escalation",
    "skid",
    "spicyomelette",
    "terra loader"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "172.96.139.82"
      },
      {
        "id": "",
        "name": "144.208.127.15"
      },
      {
        "id": "",
        "name": "108.174.197.15"
      },
      {
        "id": "",
        "name": "pin.howasit.com"
      },
      {
        "id": "",
        "name": "cbe1f43ad7a19c97a521a662dd406a3fb345ae919271cefc694a71e55fe163f5"
      },
      {
        "id": "",
        "name": "ffc89a2026fa2b2364dd180ede662fa4ac161323388f3553b6d6e4cb2601cb1f"
      },
      {
        "id": "",
        "name": "fe63fdf34d66f1658e2c9227ac84adffaa2cbb8b689999d4d1ebc733fc5f0fce"
      },
      {
        "id": "",
        "name": "bd3df53a397af4fe5e1441b2c91a6149bac9d26c94e46de9dbcbfa9b8647a935"
      },
      {
        "id": "",
        "name": "b56d2e095dc6c2171e461ca737cbdc0a35de7f4729b31fe41258f9cbd81309a1"
      },
      {
        "id": "",
        "name": "a26379ad2eb9de44691da254182ca65fb32596fe1217fe4fbddb173f361a0a9b"
      },
      {
        "id": "",
        "name": "95634a5c6a8290aaa9d287f28c7d22b3b7ca1cf974339fc89ea4d542fa2ec45a"
      },
      {
        "id": "",
        "name": "757e297137e8ed21622297ae8885740b5beb09bc07141cf8ce7b24dbd95bdaf0"
      },
      {
        "id": "",
        "name": "6f12dc858631cf90cd4fef57fbb52675b8649d777c7f86384c6535da0a59ad67"
      },
      {
        "id": "",
        "name": "4569c869047a092032f6eac7cf0547591a03a0d750a6b104a606807ea282d608"
      },
      {
        "id": "",
        "name": "4b8be22b23cd9098218a6f744baeb45c51b6fad6a559b01fe92dbb53c6e2c128"
      },
      {
        "id": "",
        "name": "408f1f982bef7ab5a79057eec4079e5e8d87a0ee83361c79469018b791c03e8f"
      },
      {
        "id": "",
        "name": "29bc115b5ae8cf19578c1c6a6743c3e53b9247d8eb6c556bc9d056994c58835b"
      },
      {
        "id": "",
        "name": "228cd867898ab0b81d31212b2da03cc3e349c9000dfb33e77410e2937cea8532"
      },
      {
        "id": "",
        "name": "aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f492015d"
      },
      {
        "id": "",
        "name": "a8a7fdbbc688029c0d97bf836da9ece926a85e78986d0e1ebd9b3467b3a72258"
      }
    ],
    "malware": [
      {
        "id": "45478769-d83d-4892-977b-f89b762ddad0",
        "name": "Cloudflared",
        "slug": "cloudflared"
      },
      {
        "id": "legacy:malware:4e6f4643ad659c00",
        "name": "Terra Loader",
        "slug": "terra-loader"
      },
      {
        "id": "819de08e-90ff-4114-b86e-6bc32942a4a3",
        "name": "More_eggs - S0284",
        "slug": "more_eggs-s0284"
      },
      {
        "id": "ab138766-9b64-4880-87fb-1942a709d778",
        "name": "Cobalt Strike - S0154",
        "slug": "cobalt-strike-s0154"
      }
    ],
    "intrusion_sets": [
      {
        "id": "2c096026-e758-4e3b-b8e5-ee458aec3f9c",
        "name": "TA4557/FIN6",
        "slug": "ta4557fin6"
      }
    ],
    "attack_patterns": [
      {
        "id": "28784df4-38e7-4195-b0aa-bd35746dfbe7",
        "name": "T1069.002"
      },
      {
        "id": "7f478f8c-06a4-4ce6-ac08-2947bca8463c",
        "name": "T1069.001"
      },
      {
        "id": "d03ba136-5188-4224-876c-26255d8c8a5b",
        "name": "T1217"
      },
      {
        "id": "a6b6df0a-93c1-4ddf-8403-2bc47590f9fe",
        "name": "T1087.001"
      },
      {
        "id": "e6c0ca23-78ee-4b0e-96fa-e80efab3665d",
        "name": "T1003.001"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "a15721d2-76b1-4869-bd1f-819afb6e368d",
        "name": "T1482"
      },
      {
        "id": "9e6c4b38-f4e1-4b1f-b90a-222f881acbab",
        "name": "T1087.002"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "19ce62bb-3faf-4d09-90b1-d82fce1ba8b0",
        "name": "T1136"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "a2ba5594-6293-4868-928c-ab4b31927a02",
        "name": "T1572"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2023-27532"
      }
    ]
  },
  "external_refs": [
    "https://thedfirreport.com/2024/12/02/the-curious-case-of-an-egg-cellent-resume/",
    "https://otx.alienvault.com/pulse/6750c1d779f14c20127c6d8e"
  ]
}