Procedure examples

APT32 malware has used rundll32.exe to execute an initial infection process.

APT32's macOS backdoor changes the permission of the file it wants to execute to 755.

APT32 has used Web shells to maintain access to victim websites.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.

APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.

APT32 has used pass the hash for lateral movement.

APT32 successfully gained remote access by using pass the ticket.

APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

APT32's macOS backdoor hides the clientID file via a chflags function.

APT32 has used the WindowStyle parameter to conceal PowerShell windows.

APT32 used NTFS alternate data streams to hide their payloads.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

APT32 has sent spearphishing emails containing malicious links.

APT32's backdoor has used Windows services as a way to execute its malicious payload.

APT32 has deployed tools after moving laterally using administrative accounts.

An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).

APT32 has set up and operated websites to gather information and deliver malware.

APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.

APT32 has set up Facebook pages in tandem with fake websites.

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

APT32 has conducted targeted surveillance against activists and bloggers.

APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.

APT32 has used malicious links to direct users to web pages designed to harvest credentials.

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.

APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.

APT32 has cleared select event log entries.