Procedure examples

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.

During Operation MidnightEclipse, threat actors used SMB to pivot internally in victim networks.

During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.

During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.

During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.

During Operation MidnightEclipse, threat actors used `wget` via HTTP to retrieve payloads.

During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.

During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.

During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.

During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.

During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.