Skip to content

Hide Navigation Hide TOC

SHIPSHAPE - S0028 (b1de6916-7a22-4460-8d26-6b5483ffaa2a)

SHIPSHAPE is malware developed by APT30 that allows propagation and exfiltration of data over removable devices. APT30 may use this capability to exfiltrate data across air-gaps. (Citation: FireEye APT30)

Cluster A Galaxy A Cluster B Galaxy B Level
SHIPSHAPE - S0028 (b1de6916-7a22-4460-8d26-6b5483ffaa2a) Malware Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern 1
SHIPSHAPE - S0028 (b1de6916-7a22-4460-8d26-6b5483ffaa2a) Malware Shortcut Modification - T1547.009 (4ab929c6-ee2d-4fb5-aab4-b14be2ed7179) Attack Pattern 1
SHIPSHAPE - S0028 (b1de6916-7a22-4460-8d26-6b5483ffaa2a) Malware Replication Through Removable Media - T1091 (3b744087-9945-4a6f-91e8-9dbceda417a4) Attack Pattern 1
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2
Shortcut Modification - T1547.009 (4ab929c6-ee2d-4fb5-aab4-b14be2ed7179) Attack Pattern Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern 2