Procedure examples

APT42 has used malware, such as GHAMBAR and POWERPOST, to collect network information.

APT42 has masqueraded the VINETHORN payload as a VPN application.

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT42 has used scheduled tasks for persistence.

APT42 has used credential harvesting websites.

APT42 has used custom malware to log keystrokes.

APT42 has downloaded and executed PowerShell payloads.

APT42 has used a VBScript to query anti-virus products.

APT42 has cleared Chrome browser history.

APT42 has deleted login notification emails and has cleared the Sent folder to cover their tracks.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

APT42 has used malware, such as GHAMBAR and POWERPOST, to collect system information.

APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.

APT42 has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.

APT42 has intercepted SMS-based one-time passwords and has set up two-factor authentication. Additionally, APT42 has used cloned or fake websites to capture MFA tokens.

APT42 has modified Registry keys to maintain persistence.

APT42 has used malware, such as GHAMBAR and POWERPOST, to take screenshots.

APT42 has encoded C2 traffic with Base64.

APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.

APT42 has collected data from Microsoft 365 environments.

APT42 has used custom malware to steal login and cookie data from common browsers.

APT42 has modified the Registry to maintain persistence.

APT42 has used custom malware to steal credentials.

APT42 has sent spearphishing emails containing malicious links.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

APT42 has registered domains, several of which masqueraded as news outlets and login services, for use in operations.

APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.

APT42 has created email accounts to use in spearphishing operations.

APT42 has used built-in features in the Microsoft 365 environment and publicly available tools to avoid detection.

APT42 has used its infrastructure for C2 and for staging the VINETHORN payload, which masqueraded as a VPN application.

APT42 has leveraged LLMs to search for official emails to build target lists, and conduct reconnaissance on potential business partners.

APT42 has impersonated legitimate people in phishing emails to gain credentials.