Threat Profile: Santa Claus
Santa Claus
Santa Claus (and his associates, the elves) are a north-pole-based physical threat group. Specializations include advanced reconnaissance-at-scale, payload manufacturing / delivery and initial access operations (IAO). Legends indicate this group began a series of world-wide campaigns as early as 280 AD and continue to this day.
ID: G1225
Associated Names: Sinterklaas, Der Weihnachtsmann, Kriss Kringle, Père Noël, Noel Baba, Babbo Natale, Shaka Santa
Version: 1.0
Created: 24 Dec 2022
Last Modified: 24 Dec 2022
Techniques Used
| Tactic | ID | Name | Use |
|---|---|---|---|
| Reconnaissance | T1595 | Active Scanning | He see’s you when you’re sleeping, he knows when you’re awake… |
| Reconnaissance | T1592 | Gather Victim Host Information | Determines household ingress points |
| Reconnaissance | T1589.003 | Gather Victim Identity Information | He makes a list (and checks it twice) |
| Resource Development | T1587 | Develop Capabilities | Toy manufacturing |
| Initial Access | T1189 | Fly-by Compromise | Reindeer-based delivery system |
| Initial Access | T1190 | Exploit Public-Facing Chimney | Preferred inital access vector via chimney |
| Initial Access | T1195 | Supply Chain Compromise | Elves make the toys, but what do they embed? |
| Initial Access | T1199 | Trusted Relationship | He’s pretty much invited in yeah? |
| Execution | T1610 | Deploy Container | Lots of wrapped containers are delivered |
| Execution | T1053 | Scheduled Task/Job | Every year, same time. |
| Persistence | T1525 | Implant Internal Image | Quite an impression is made on the little ones. |
| Defense Evasion | T1562.004 | Impair Defenses | Disables or modifies system fireplace |
| Lateral Movement | T1210 | Exploitation of Remote Services | Moving from house to house |
| Exfiltration | T1052 | Exfiltration Over Physical Medium | He takes the cookies and back up the chimney he goes! |
| Impact | T1485 | Cookie Destruction | Nom nom nom (and drinks the milk!) |
| Impact | T1491 | Defacement | Well between the tree, the lights, the decorations and the gift wrap, my house is always a mess… |
