Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
Malware family
DanBot
DanBot is a backdoor associated with the Lyceum threat group.
Profile source: Mallory opens in a new tabDanBot
Family profile
DanBot is a backdoor associated with the Lyceum threat group. It has been delivered via spearphishing emails containing malicious Excel attachments and relies on victim interaction to execute, including opening the malicious file. The malware can use a VBA macro embedded in an Excel file to drop its payload and can establish installation or persistence through a scheduled task. DanBot samples have been named UltraVNC.exe and WINVNC.exe to masquerade as legitimate VNC tools. Reported capabilities include uploading files from compromised hosts. The provided content identifies DanBot as one of the major tools attributed to Lyceum, alongside the Shark, Milan, and Marlin backdoors.
Reported operators
Threat actors
2 named in public reportingMajor tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
MITRE ATT&CK
DanBot in ATT&CK
19 distinct techniquesTechniques
19 techniques T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols T1204.002 Malicious File T1041 Exfiltration Over C2 Channel T1059.003 Windows Command Shell T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1053.005 Scheduled Task T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1204 User Execution T1053 Scheduled Task/Job T1059.005 Visual Basic T1005 Data from Local System T1027.013 Encrypted/Encoded File T1105 Ingress Tool Transfer T1071.004 DNS T1021.005 VNC
Reporting
Research mentioning DanBot
Jun 5
Eset Welivesecurity
BladedFeline: Whispering in the dark
Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
Dec 14
Eset Welivesecurity
OilRig’s persistent attacks using cloud service-powered downloaders
Major tools we attribute to Lyceum include DanBot, the Shark, Milan, and Marlin backdoors...
Nov 19
Mitre Attack Website
User Execution: Malicious File, Sub-technique T1204.002 - Enterprise | MITRE ATT&CK®
DanBot has relied on victims' opening a malicious file for initial execution.
Nov 19
Mitre Attack Website
Scheduled Task/Job: Scheduled Task, Sub-technique T1053.005 - Enterprise | MITRE ATT&CK®
DanBot can use a scheduled task for installation.
Mar 7
Mitre Attack Website
Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®
DanBot can use a VBA macro embedded in an Excel file to drop the payload.
May 20
Mitre Attack Website
User Execution: Malicious File, Sub-technique T1204.002 - Enterprise | MITRE ATT&CK®
DanBot has relied on victims' opening a malicious file for initial execution.
May 20
Mitre Attack Website
Phishing: Spearphishing Attachment, Sub-technique T1566.001 - Enterprise | MITRE ATT&CK®
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.
