Procedure examples

APT39 has used different versions of Mimikatz to obtain credentials.

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.

APT39 has used various tools to steal files from the compromised host.

APT39 has used various strains of malware to query the Registry.

APT39 has used NBTscan and custom tools to discover remote systems.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

APT39 has used SMB for lateral movement.

APT39 used secure shell (SSH) to move laterally among their targets.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

APT39 has used malware to drop encrypted CAB files.

APT39 used Remexi to collect usernames from the system.

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.

APT39 has exfiltrated stolen victim data through C2 communications.

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.

APT39 has created scheduled tasks for persistence.

APT39 has utilized tools to capture mouse movements.

APT39 has used tools for capturing keystrokes.

APT39 has utilized custom scripts to perform internal reconnaissance.

APT39 has used PowerShell to execute malicious code.

APT39 has utilized malicious VBS scripts in malware.

APT39 has used a command line utility and a network scanner written in python.

APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.

APT39 has used malware to delete files after they are deployed on a compromised host.

APT39 has used HTTP in communications with C2.

APT39 has used remote access tools that leverage DNS in communications with C2.

APT39 has utilized tools to aggregate data prior to exfiltration.

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).

APT39 has used tools with the ability to search for files on a compromised host.

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

APT39 has used various tools to proxy C2 communications.

APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.

APT39 has downloaded tools to compromised hosts.

APT39 has used Ncrack to reveal credentials.

APT39 has used a screen capture utility to take screenshots on a compromised host.

APT39 has used tools capable of stealing contents of the clipboard.

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

APT39 has created accounts on multiple compromised hosts to perform actions within the network.

APT39 has used malware to decrypt encrypted CAB files.

APT39 has used SQL injection for initial compromise.

APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

APT39 has installed ANTAK and ASPXSPY web shells.

APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.

APT39 has maintained persistence using the startup folder.

APT39 has modified LNK shortcuts.

APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.