04-cti-report.json

{
  "version": "2.7.0",
  "schema": "killchain-export-lite",
  "exportedAt": "2026-02-10T09:00:00.000Z",
  "title": "UC4 — Aerospace Espionage Campaign: CTI Report",
  "description": "CTI report for an aerospace espionage campaign, combining ATT&CK techniques with rich STIX objects to tell the kill chain narrative.",
  "view": "killchain",
  "activeTab": "custom",
  "layers": {
    "attack": true,
    "capec": true,
    "cwe": true,
    "custom": true
  },
  "hideEmpty": true,
  "customLibrary": {
    "threat-actor--37520548-fd0c-48ea-841a-c46fd32b930c": {
      "id": "threat-actor--37520548-fd0c-48ea-841a-c46fd32b930c",
      "stixType": "threat-actor",
      "name": "SkyForge",
      "description": "State-sponsored threat actor attributed to a foreign military intelligence service. Active since 2021. Targets aerospace, defense, and satellite communications sectors. Known for patient intrusions with custom tooling and satellite-themed infrastructure naming.",
      "labels": [
        "nation-state",
        "espionage",
        "aerospace"
      ],
      "created": "2026-01-15T08:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "threat_actor_types": [
        "nation-state",
        "spy"
      ],
      "aliases": [
        "UNC7733",
        "BRONZE ORBITER",
        "Celestial Spider"
      ],
      "first_seen": "2021-06-15T00:00:00.000Z",
      "last_seen": "2026-01-20T00:00:00.000Z",
      "roles": [
        "agent",
        "malware-author",
        "infrastructure-operator"
      ],
      "goals": [
        "Steal aerospace trade secrets",
        "Access satellite communication protocols",
        "Monitor defense procurement intelligence"
      ],
      "sophistication": "expert",
      "resource_level": "government",
      "primary_motivation": "organizational-gain"
    },
    "intrusion-set--dd166b5e-3c91-4350-8aaa-4fd9470c3a99": {
      "id": "intrusion-set--dd166b5e-3c91-4350-8aaa-4fd9470c3a99",
      "stixType": "intrusion-set",
      "name": "Operation Zenith",
      "description": "Targeted cyber-espionage campaign against aerospace contractors in NATO and Five Eyes nations. Q2 2025 to present. Focused on next-generation fighter jet avionics designs and satellite ground station protocols.",
      "labels": [
        "espionage",
        "aerospace",
        "multi-victim"
      ],
      "created": "2026-01-20T10:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "aliases": [
        "ZENITH-25",
        "SKYFALL Campaign"
      ],
      "first_seen": "2025-04-01T00:00:00.000Z",
      "last_seen": "2026-01-20T00:00:00.000Z",
      "goals": [
        "Exfiltrate avionics design documents",
        "Access satellite ground station source code"
      ],
      "resource_level": "government",
      "primary_motivation": "organizational-gain"
    },
    "campaign--73ad0606-2bfe-4674-b87e-8b74edf65719": {
      "id": "campaign--73ad0606-2bfe-4674-b87e-8b74edf65719",
      "stixType": "campaign",
      "name": "ZENITH Phase 1 — Initial Access Wave",
      "description": "First phase targeting HR departments of 6 aerospace contractors with LinkedIn-sourced spearphishing. April–July 2025.",
      "labels": [
        "phase-1",
        "initial-access",
        "spearphishing"
      ],
      "created": "2026-01-22T09:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "first_seen": "2025-04-15T00:00:00.000Z",
      "last_seen": "2025-07-30T00:00:00.000Z",
      "objective": "Establish persistent access in at least 3 of 6 targeted aerospace contractors."
    },
    "malware--ef58bf35-6405-4f38-a9e8-0a22d8a47beb": {
      "id": "malware--ef58bf35-6405-4f38-a9e8-0a22d8a47beb",
      "stixType": "malware",
      "name": "OrbitRAT",
      "description": "Custom Go-based RAT attributed to SkyForge. Communicates via gRPC over mTLS with certificate pinning. Supports file exfiltration, screenshot capture, keylogging, and browser credential theft. Anti-analysis: checks hypervisor CPUID leaf, detects common sandbox MAC prefixes.",
      "labels": [
        "rat",
        "custom",
        "golang"
      ],
      "created": "2026-01-16T10:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "is_family": true,
      "malware_types": [
        "remote-access-trojan",
        "backdoor",
        "spyware"
      ],
      "aliases": [
        "OrbitRAT",
        "SatComLoader"
      ],
      "first_seen": "2023-11-20T00:00:00.000Z",
      "last_seen": "2026-01-15T00:00:00.000Z",
      "implementation_languages": [
        "go"
      ],
      "capabilities": [
        "communicates-with-c2",
        "exfiltrates-data",
        "captures-input-peripherals",
        "anti-debugging",
        "anti-sandbox"
      ]
    },
    "infrastructure--126dc140-ee70-4287-a5f8-36f377c7aebd": {
      "id": "infrastructure--126dc140-ee70-4287-a5f8-36f377c7aebd",
      "stixType": "infrastructure",
      "name": "Zenith C2 — gRPC over mTLS",
      "description": "Distributed C2 infrastructure using gRPC over mutual TLS. 8 active nodes across Linode (Singapore), OVH (France), and Hetzner (Finland). Certificate pinning prevents interception. Nodes rotate on a 48-hour cycle.",
      "labels": [
        "c2",
        "grpc",
        "mtls"
      ],
      "created": "2026-01-18T14:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "infrastructure_types": [
        "command-and-control"
      ],
      "first_seen": "2025-04-01T00:00:00.000Z",
      "last_seen": "2026-01-20T00:00:00.000Z"
    },
    "identity--30705aa7-f856-456b-9804-85ac0a27c177": {
      "id": "identity--30705aa7-f856-456b-9804-85ac0a27c177",
      "stixType": "identity",
      "name": "AeroTech Dynamics Ltd",
      "description": "Primary victim. UK-based aerospace contractor specializing in next-gen fighter jet avionics systems for the Tempest programme. 4,200 employees. MoD contractor clearance: SECRET.",
      "labels": [
        "victim",
        "aerospace",
        "uk"
      ],
      "created": "2026-01-15T08:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "identity_class": "organization",
      "sectors": [
        "aerospace",
        "defense"
      ],
      "contact_information": "CISO: ciso@aerotech-dynamics.example.com"
    },
    "indicator--5c51dd1d-260f-4a96-8a95-d94956ce2a91": {
      "id": "indicator--5c51dd1d-260f-4a96-8a95-d94956ce2a91",
      "stixType": "indicator",
      "name": "OrbitRAT v4.1 SHA-256",
      "description": "SHA-256 of OrbitRAT v4.1 ELF binary recovered from compromised Linux build server at AeroTech.",
      "labels": [
        "malicious-activity",
        "file-hash"
      ],
      "created": "2026-01-17T13:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "pattern": "[file:hashes.'SHA-256' = 'b5c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0']",
      "pattern_type": "stix",
      "valid_from": "2025-05-01T00:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ]
    },
    "indicator--ef184ae2-0f94-410f-8d26-107d0978c378": {
      "id": "indicator--ef184ae2-0f94-410f-8d26-107d0978c378",
      "stixType": "indicator",
      "name": "C2 Domain — satcom-update-svc.com",
      "description": "Primary gRPC C2 domain used by OrbitRAT. Registered via Njalla privacy registrar. DNS resolves to rotating Linode/OVH IPs.",
      "labels": [
        "malicious-activity",
        "c2-domain"
      ],
      "created": "2026-01-19T15:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "pattern": "[domain-name:value = 'satcom-update-svc.com']",
      "pattern_type": "stix",
      "valid_from": "2025-04-01T00:00:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ]
    },
    "report--a2ff9c4d-60a3-4d8d-a792-d4af3ce67642": {
      "id": "report--a2ff9c4d-60a3-4d8d-a792-d4af3ce67642",
      "stixType": "report",
      "name": "Operation Zenith — Threat Intelligence Report Q1 2026",
      "description": "Comprehensive CTI report covering Operation Zenith: TTPs, IOCs, victim analysis, SkyForge attribution, and recommended mitigations. Classification: TLP:AMBER.",
      "labels": [
        "threat-report",
        "tlp-amber",
        "aerospace"
      ],
      "created": "2026-02-01T08:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "published": "2026-02-08T00:00:00.000Z",
      "report_types": [
        "threat-report",
        "campaign",
        "intrusion-set"
      ]
    },
    "opinion--b6a17cc2-91d3-4bfe-b363-67f5494a90d5": {
      "id": "opinion--b6a17cc2-91d3-4bfe-b363-67f5494a90d5",
      "stixType": "opinion",
      "name": "Five Eyes Partner Concurrence",
      "description": "Attribution concurrence from Five Eyes partner agency.",
      "labels": [
        "peer-review",
        "attribution"
      ],
      "created": "2026-02-07T10:00:00.000Z",
      "modified": "2026-02-10T09:00:00.000Z",
      "opinion": "agree",
      "explanation": "Independent SIGINT and HUMINT corroborate SkyForge attribution with HIGH confidence. Overlapping infrastructure with previously reported BRONZE ORBITER campaigns targeting Australian defence primes.",
      "authors": [
        "Allied SIGINT Partner — Redacted"
      ]
    }
  },
  "assignments": {
    "IN:reconnaissance": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [
        {
          "groupId": "grp-cti-attribution",
          "label": "Attribution Context",
          "collapsed": false,
          "items": [
            {
              "type": "attack",
              "id": "T1589.002",
              "instanceId": "itm-auto-1770835608204-9",
              "metadata": {
                "score": "medium",
                "confidence": 60,
                "comments": "LinkedIn harvesting of employee profiles at AeroTech Dynamics. SkyForge created 3 sock puppet recruiter accounts (identified post-compromise). Collected names, roles, and email patterns for spearphishing targeting.",
                "cves": [],
                "hyperlinks": [],
                "observables": []
              }
            },
            {
              "type": "custom",
              "id": "threat-actor--37520548-fd0c-48ea-841a-c46fd32b930c",
              "instanceId": "itm-cti-ta1",
              "metadata": {}
            },
            {
              "type": "custom",
              "id": "intrusion-set--dd166b5e-3c91-4350-8aaa-4fd9470c3a99",
              "instanceId": "itm-cti-is1",
              "metadata": {}
            }
          ]
        }
      ],
      "layout": [
        {
          "kind": "group",
          "groupId": "grp-cti-attribution"
        }
      ]
    },
    "IN:resource-development": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "infrastructure--126dc140-ee70-4287-a5f8-36f377c7aebd",
          "instanceId": "itm-cti-infra1",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-infra1"
        }
      ]
    },
    "IN:delivery": {
      "techniques": [
        {
          "id": "T1566.001",
          "metadata": {
            "score": "high",
            "confidence": 85,
            "comments": "Spearphishing with ISO-embedded LNK file targeting HR department. Emails spoofed Rolls-Royce recruitment. ISO contained OrbitRAT loader disguised as job application PDF viewer.",
            "cves": [],
            "hyperlinks": [],
            "observables": [
              {
                "type": "email-addr",
                "value": "careers-rr@aerospace-talent.com"
              },
              {
                "type": "file-name",
                "value": "RR_Senior_Avionics_Engineer_2025.iso"
              }
            ]
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "campaign--73ad0606-2bfe-4674-b87e-8b74edf65719",
          "instanceId": "itm-cti-camp1",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-camp1"
        }
      ]
    },
    "IN:social-engineering": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "IN:exploitation": {
      "techniques": [
        {
          "id": "T1204.002",
          "metadata": {
            "score": "high",
            "confidence": 90,
            "comments": "User execution of LNK file inside ISO mount. LNK executes PowerShell cradle downloading OrbitRAT from cloud-hosted staging server.",
            "cves": [],
            "hyperlinks": [],
            "observables": [
              {
                "type": "file-name",
                "value": "View_Application.lnk"
              }
            ]
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "malware--ef58bf35-6405-4f38-a9e8-0a22d8a47beb",
          "instanceId": "itm-cti-mal1",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-mal1"
        }
      ]
    },
    "IN:persistence": {
      "techniques": [
        {
          "id": "T1543.003",
          "metadata": {
            "score": "high",
            "confidence": 80,
            "comments": "OrbitRAT installs as a Windows service (DisplayName: 'Satellite Telemetry Service'). Service binary in C:\\ProgramData\\SatComSvc\\.",
            "cves": [],
            "hyperlinks": [],
            "observables": [
              {
                "type": "file-name",
                "value": "satcomsvc.exe"
              }
            ]
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "IN:defense-evasion": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "IN:command-control": {
      "techniques": [
        {
          "id": "T1095",
          "metadata": {
            "score": "high",
            "confidence": 88,
            "comments": "gRPC over mTLS C2 channel. Certificate pinning prevents proxy interception. Beacon interval: 300 seconds with 20% jitter. 8 rotating C2 nodes.",
            "cves": [],
            "hyperlinks": [],
            "observables": [
              {
                "type": "domain-name",
                "value": "satcom-update-svc.com"
              },
              {
                "type": "ipv4-addr",
                "value": "139.162.15.42"
              }
            ]
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "indicator--5c51dd1d-260f-4a96-8a95-d94956ce2a91",
          "instanceId": "itm-cti-ind1",
          "type": "custom",
          "metadata": {}
        },
        {
          "id": "indicator--ef184ae2-0f94-410f-8d26-107d0978c378",
          "instanceId": "itm-cti-ind2",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-ind1"
        },
        {
          "kind": "item",
          "instanceId": "itm-cti-ind2"
        }
      ]
    },
    "THROUGH:pivoting": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "THROUGH:discovery": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "THROUGH:privilege-escalation": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "THROUGH:execution": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "THROUGH:credential-access": {
      "techniques": [
        {
          "id": "T1555.003",
          "metadata": {
            "score": "high",
            "confidence": 75,
            "comments": "OrbitRAT module extracts credentials from Chrome and Edge browsers. Targeted engineering team members with access to internal Git repositories containing avionics source code.",
            "cves": [],
            "hyperlinks": [],
            "observables": []
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "THROUGH:lateral-movement": {
      "techniques": [
        {
          "id": "T1021.004",
          "metadata": {
            "score": "high",
            "confidence": 70,
            "comments": "SSH lateral movement to Linux build servers using stolen developer credentials from browser credential theft.",
            "cves": [],
            "hyperlinks": [],
            "observables": []
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "identity--30705aa7-f856-456b-9804-85ac0a27c177",
          "instanceId": "itm-cti-id1",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-id1"
        }
      ]
    },
    "OUT:collection": {
      "techniques": [
        {
          "id": "T1213.003",
          "metadata": {
            "score": "critical",
            "confidence": 80,
            "comments": "Git clone of internal avionics design repositories. 3 repos totaling 4.7 GB cloned from internal GitLab. Included Tempest avionics schematics and satellite ground station protocol specifications.",
            "cves": [],
            "hyperlinks": [],
            "observables": []
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "OUT:exfiltration": {
      "techniques": [
        {
          "id": "T1041",
          "metadata": {
            "score": "critical",
            "confidence": 85,
            "comments": "4.7 GB exfiltrated over gRPC C2 channel in chunked, encrypted transfers over 21 days. OrbitRAT's built-in file exfiltration module.",
            "cves": [],
            "hyperlinks": [],
            "observables": []
          }
        }
      ],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    },
    "OUT:impact": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [
        {
          "id": "report--a2ff9c4d-60a3-4d8d-a792-d4af3ce67642",
          "instanceId": "itm-cti-report1",
          "type": "custom",
          "metadata": {}
        },
        {
          "id": "opinion--b6a17cc2-91d3-4bfe-b363-67f5494a90d5",
          "instanceId": "itm-cti-opinion1",
          "type": "custom",
          "metadata": {}
        }
      ],
      "groups": [],
      "layout": [
        {
          "kind": "item",
          "instanceId": "itm-cti-report1"
        },
        {
          "kind": "item",
          "instanceId": "itm-cti-opinion1"
        }
      ]
    },
    "OUT:objectives": {
      "techniques": [],
      "capecs": [],
      "cwes": [],
      "customItems": [],
      "groups": [],
      "layout": []
    }
  }
}