[Intel]: https://www.mandiant.com/resources/unc3524-eye-spy-email

[timb-machine]

Area

Malware reports

Parent threat

Resource Development, Persistence, Defense Evasion, Lateral Movement

Finding

https://www.mandiant.com/resources/unc3524-eye-spy-email

Industry reference

attack:T1021.004:SSH
attack:T1027:Obfuscated Files or Information
attack:T1037.004:RC Scripts
attack:T1584:Compromise Infrastructure

Malware reference

QUIETEXIT

Actor reference

unc3524

Component

Linux, IOT

Scenario

Internal enterprise services

Scenario variation

Device agent/gateway deployment