Procedure examples

Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.

Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.

Daggerfly has attempted to use scheduled tasks for persistence in victim environments.

Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.

Daggerfly uses HTTP for command and control communication.

Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.

Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.

Daggerfly created a local account on victim machines to maintain access.

Daggerfly has used strategic website compromise for initial access against victims.

Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.

Daggerfly created code signing certificates to sign malicious macOS files.