Procedure examples

During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

During Operation Wocao, threat actors collected a list of installed software on the infected system.

During Operation Wocao, threat actors used scripts to detect security software.

During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.

During Operation Wocao, threat actors accessed and collected credentials from password managers.

During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.

During Operation Wocao, threat actors created services on remote systems for execution purposes.

During Operation Wocao, threat actors used SMB to copy files to and from target systems.

During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 47000.

During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.

For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.

For Operation Wocao, the threat actors registered email accounts to use during the campaign.

During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.

For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.

During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.

During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model.

During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.

During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.