CostaRicto
CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1583 | .001 | Acquire Infrastructure: Domains |
For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.[1] |
| Enterprise | T1005 | Data from Local System |
During CostaRicto, the threat actors collected data and files from compromised networks.[1] |
|
| Enterprise | T1587 | .001 | Develop Capabilities: Malware |
For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.[1] |
| Enterprise | T1133 | External Remote Services |
During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.[1] |
|
| Enterprise | T1105 | Ingress Tool Transfer |
During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.[1] |
|
| Enterprise | T1046 | Network Service Discovery |
During CostaRicto, the threat actors employed nmap and pscan to scan target environments.[1] |
|
| Enterprise | T1588 | .002 | Obtain Capabilities: Tool |
During CostaRicto, the threat actors obtained open source tools to use in their operations.[1] |
| Enterprise | T1572 | Protocol Tunneling |
During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.[1] |
|
| Enterprise | T1090 | .003 | Proxy: Multi-hop Proxy |
During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.[1] |
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.[1] |
Software
| ID | Name | Description |
|---|---|---|
| S0614 | CostaBricks |
During CostaRicto, threat actors used a custom VM-based payload loader named CostaBricks.[1] |
| S0194 | PowerSploit |
During CostaRicto, threat actors used PowerSploit's |
| S0613 | PS1 |
During CostaRicto, threat actors used the 64-bit backdoor loader PS1.[1] |
| S0029 | PsExec |
During CostaRicto, threat actors used PsExec.[1] |
| S0615 | SombRAT |
During CostaRicto, threat actors used SombRAT in conjuction with CostaBricks and PowerSploit.[1] |
| S0183 | Tor |
During CostaRicto, threat actors used C2 servers managed through Tor.[1] |