Tool: CARROTBALL

Description

[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://attack.mitre.org/software/S0464).(Citation: Unit 42 CARROTBAT January 2020)

External References

• mitre-attack
• Unit 42 CARROTBAT January 2020

Techniques Used by This Tool

• T1027 — Obfuscated Files or Information
• T1071.002 — File Transfer Protocols
• T1105 — Ingress Tool Transfer
• T1204.002 — Malicious File