[Intel]: https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf

[timb-machine]

Area

Malware reports

Parent threat

Execution, Persistence, Discovery, Collection, Command and Control, Exfiltration

Finding

https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf

Industry reference

attack:T1574.006:Dynamic Linker Hijacking
attack:T1059.004:Unix Shell
attack:T1053.003:Cron
attack:T1559:Inter-Process Communication
attack:T1205.001:Port Knocking
attack:T1001.003:Protocol Impersonation
attack:T1573.002:Asymmetric Cryptography
attack:T1572:Protocol Tunneling
attack:T1560.002:Archive via Library
attack:T1041:Exfiltration Over C2 Channel
attack:T1005:Data from Local System
attack:T1124:System Time Discovery
attack:T1518:Software Discovery
attack:T1071.Application Layer Protocol
uses:BPF
uses:Non-persistentStorage

Malware reference

Pygmy Goat
EarthWorm
Earthwrom
wltm

Actor reference

No response

Component

Linux

Scenario

Enterprise with satellite facilities