IOControl is a malware that targeted Linux ARM-based IoT/OT devices including Hikvision IP cameras, D-Link firewalls and routers, Unitronics PLCs and HMIs, Orpak and Gasboy fuel management systems, and Baicells LTE controllers across the United States and Israel. The malware has been attributed to CyberAv3ngers which is suspected to be affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
9
Techniques44th pct
4
Tactics32nd pct
0
Threat groupsNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
IOCONTROL has used the Advanced Encryption Standard 256-bit Cypher Block Chaining (AES-256-CBC) algorithm to encrypt its configuration files which are used to store information like file paths and IP addresses to connect to. 67
IOCONTROL has removed malware persistence from a system upon command. 14
Stealthno detection rules
Standing S9046
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 842 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques944th pct
44th percentile · 56% of 842 ATT&CK software entries have more Enterprise techniques.
Tactics432nd pct
32nd percentile · 68% of 842 ATT&CK software entries have more tactics spanned.
Threat groups062% tie · 22 values
62% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns086% tie · 8 values
86% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique4medBottom 4%
4th percentile · 96% of 842 ATT&CK software entries have more detection rules per technique.
Tests / technique6med55th pct
55th percentile · 55% of 842 ATT&CK software entries have this many atomic tests per technique or fewer.
Data comps / technique5med53% tie · 11 values
53% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique0medBottom 17%
17th percentile · 83% of 842 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 9 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)
The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...)
This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)
The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...)
The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. (...)
The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). (...)
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.
The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)
The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. (...)