Procedure examples

During Night Dragon, threat actors dumped account hashes using gsecdump.

During Night Dragon, the threat actors collected files and other data from compromised systems.

During Night Dragon, threat actors used company extranet servers as secondary C2 servers.

During Night Dragon, threat actors used software packing in its tools.

During Night Dragon, threat actors used a DLL that included an XOR-encoded section.

During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.

During Night Dragon, threat actors used HTTP for C2.

During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Night Dragon, threat actors used domain accounts to gain further access to victim systems.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.

During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.

During Night Dragon, threat actors used Cain & Abel to crack password hashes.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.

During Night Dragon, threat actors used RAT malware to exfiltrate email archives.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.

During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.

During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.

During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.

During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.

During Night Dragon, threat actors used dynamic DNS services for C2.

During Night Dragon, threat actors purchased hosted services to use for C2.

During Night Dragon, threat actors compromised web servers to use for C2.

During Night Dragon, threat actors used Trojans from underground hacker websites.

During Night Dragon, threat actors obtained and used tools such as gsecdump.

During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.

During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.