Rising Sun

MITRE ATT&CK: S0448 View on attack.mitre.org

Aliases: Rising Sun

First seen
2018-12-01 00:00:00
Malware type
backdoor, trojan
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:46:36

Targeted industries: defense-and-aerospace energy-and-utilities financial-services

Context

Rising Sun is a modular backdoor that was used extensively in Operation Sharpshooter between 2017 and 2019. Rising Sun infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed Rising Sun included some source code from Lazarus Group's Trojan Duuzer.

Detection coverage

  • 243 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Data from Local System (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Archive via Custom Method (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Web Protocols (attack-pattern)
  • Indicator Removal (attack-pattern)
  • Process Discovery (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Internet Connection Discovery (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Query Registry (attack-pattern)
  • Native API (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)

Used by threat actors

  • Operation Sharpshooter (campaign)

Reports & references

  • McAfee — Operation Sharpshooter Targets Global Defense Critical Infrastructure (report)
  • McAfee — Rp Operation Sharpshooter (report)
  • ti.qianxin.com — Cb78386A082F465F259B37Dae5Df4884 (report)
  • blog.apnic.net — How To Detect And Prevent Common Data Exfiltration Attacks (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Rising Sun (report)
  • MITRE ATT&CK — S0448 (report)

External references