Threat Actor Characterization
Threat Group-1314
ID: 3d0c8b74ca2ad7144e18bb7ee6b1845883307Actor Network Graph
Open Network GraphMITRE ATT&CK®
Threat Group-1314 (G0028) is an unattributed intrusion set that used stolen credentials to access Internet-facing remote access (e.g., Citrix) and then moved laterally by abusing enterprise tools such as Altiris, spawning Windows command shells and mapping network shares via SMB.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1133 | External Remote Services | TA0001 TA0003 |
|
| T1078.002 | Domain Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1072 | Software Deployment Tools | TA0002 TA0008 |
|
| T1059.003 | Windows Command Shell | TA0002 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Threat Group-1314 (MITRE G0028) is an unattributed intrusion set observed circa 2015 leveraging compromised credentials to enter enterprise environments through remote access infrastructure (e.g., Internet-facing Citrix/VPN) and then moving laterally using built-in admin tools and endpoint management platforms. Dell Secureworks documents a TG-1314 case where the actors authenticated to a Citrix server, abused Altiris (endpoint management) for lateral movement, spawned remote shells (e.g., via PsExec), and mapped network drives with net use using compromised domain credentials tied to Altiris. MITRE summarizes the group as using compromised creds to log into victim remote access infrastructure and links technique mappings to Valid Accounts, Remote Services (SMB/Windows Admin Shares), Windows Command Shell, and Software Deployment Tools (Altiris). Overall confidence in these core facts: high.
- Industries/Sectors: Not explicitly attributed across sectors in public sources; at least one incident investigated by Secureworks involves an enterprise with Altiris deployed (common in large corporate IT). INFERENCE (confidence: low).
- Geography (Region): Not specified; technique set is globally applicable to enterprises using Citrix/VPN and endpoint management suites. INFERENCE (confidence: low).
- Countries (if available): Not specified in primary sources.
- Timeframe: 2015–2017+ (Secureworks case published 2015-05-28; MITRE G0028 cataloged 2017-05-31, with page updates through 2025-04).