Bought or Stolen Malware: Defending Against T1588.001

Obtain Capabilities: Malware (T1588.001) is a resource development technique tagged PRE. The adversary buys, steals or downloads malware that someone else made.

How attackers use it

MITRE lists payloads, droppers, post-compromise tools, backdoors, packers and command and control protocols. Adversaries acquire them to keep control of remote machines, evade defenses and carry out post-compromise behavior.

Besides free downloads, adversaries may buy malware from technology companies that specialize in it, from criminal marketplaces, including malware as a service (MaaS), or from individuals. They may also steal malware from third parties, including other adversaries, and reuse it.

The result is that unrelated intrusions can share tooling. Skill level is no longer a good guide to what you are facing.

How to detect it

MITRE suggests monitoring for contextual data about a payload: compilation times, file hashes, watermarks and other identifiable configuration information. It also suggests analyzing malware for features that may point to malware providers, such as the compiler used, debugging artifacts, code similarities, or group identifiers tied to specific MaaS offerings. Malware repositories can help find more samples tied to the developers and the adversaries using their services.

MITRE says much of the activity is outside your visibility, so effort should focus on post-compromise phases.

For defenders who handle samples, preserve hashes, configuration data and timestamps. Overlaps in malware use between different adversaries can then be found, as MITRE notes.

For defenders who do not, rely on behavior: unusual processes, new persistence entries, and connections from hosts that do not normally make them.

Click through it at your own pace, or open it full screen.

How to reduce the risk

MITRE lists Pre-compromise as the mitigation: no easy preventive control stops someone from buying malware.

You can still reduce its reach.

• Block or sandbox the common delivery paths: email attachments, downloads and removable media.
• Use application control to stop unknown executables.
• Patch quickly, since commodity malware often arrives through known flaws.
• Share and consume threat intelligence about malware families that target your sector.
• In your software supply chain, check packages before adding them. Malware also reaches developers through look-alike package names, and checking where a dependency came from is the dependency version of checking an attachment.

A last practical point concerns response. When you find commodity malware, resist the idea that it is low risk. Because adversaries buy and share malware, the same family may be one stage of a larger intrusion. Scope the incident by looking for other tools, new accounts and persistence entries on the host and its neighbors, and keep the sample and its hashes for later comparison.

Check your own environment

• Do you collect file hashes for executables that run on endpoints, so that you can search by hash later?
• Is a sandbox or detonation service part of your email or web gateway?
• Linux, read-only: sha256sum suspicious_file gives a hash to look up. On macOS use shasum -a 256.
• For dependencies, a free in-browser scan is available at https://gold.safeguard.sh/scan (no login, the file stays on your machine, up to 100 dependencies).

Quick check

Sources

• MITRE ATT&CK T1588.001: Malware