Frankenstein

Frankenstein is a threat actor/campaign tracked in the provided content under the name Frankenstein. The content associates it with spearphishing emails delivering trojanized Microsoft Word documents for initial compromise. Post-compromise, Frankenstein used PowerShell to run a series of base64-encoded commands that acted as a stager and enumerated hosts. The actor also used Empire to automatically gather the username, domain name, machine name, and other system information from compromised systems, including obtaining the compromised machine's name. For defensive evasion and environment awareness, Frankenstein used WMI queries to determine whether analysis tools were running on a compromised system. The content also states that Frankenstein communicated with command-and-control infrastructure via an encrypted RC4 byte stream and AES-CBC. No additional aliases or sub-groups are provided beyond the name Frankenstein.