Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.
|Enterprise||T1027||Obfuscated Files or Information|
|Enterprise||T1566||.001||Phishing: Spearphishing Attachment|
|.002||Phishing: Spearphishing Link|
|Enterprise||T1204||.001||User Execution: Malicious Link|
|.002||User Execution: Malicious File|
|S0444||ShimRat||Abuse Elevation Control Mechanism: Bypass User Account Control, Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data from Local System, Deobfuscate/Decode Files or Information, Event Triggered Execution: Application Shimming, Fallback Channels, File and Directory Discovery, Hijack Execution Flow, Indicator Removal on Host: File Deletion, Ingress Tool Transfer, Masquerading: Masquerade Task or Service, Modify Registry, Native API, Network Share Discovery, Obfuscated Files or Information, Obfuscated Files or Information: Software Packing, Proxy: External Proxy, Scheduled Transfer|
|S0445||ShimRatReporter||Account Discovery, Application Layer Protocol: Web Protocols, Archive Collected Data, Automated Collection, Automated Exfiltration, Exfiltration Over C2 Channel, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Native API, Obfuscated Files or Information, Permission Groups Discovery, Process Discovery, Software Discovery, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery|