Procedure examples

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine. Additionally, APT38 has downloaded other payloads onto a victim’s machine.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.

The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.

GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.

APT3 has a tool that can copy files to remote machines.

Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.

Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.

Patchwork payloads download additional files from the C2 server.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

Dragonfly has copied and installed tools for operations once in the victim environment.

Evilnum can deploy additional components or tools as needed.

Gorgon Group malware can download additional files from C2 servers.

menuPass has installed updates and new malware on victims.

APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.

MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Storm-1811 has used scripted `cURL` commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

APT18 can upload a file to the victim’s machine.

Andariel has downloaded additional tools and malware onto compromised hosts.

Sidewinder has used LNK files to download remote files to the victim's network.

Mustang Panda has downloaded additional executables following the initial infection stage. Mustang Panda has also leveraged Visual Studio Code `code.exe` and Dev Tunnels using `DevTunnel.exe` to propagate additional tools and payloads.

ZIRCONIUM has used tools to download malicious files to compromised hosts.

Rocke used malware to download additional malicious files to the target system.

Scattered Spider has downloaded the Teleport remote access tool to compromised VMware vCenter Servers.

APT39 has downloaded tools to compromised hosts.

TA2541 has used malicious scripts and macros with the ability to download additional payloads.

APT37 has downloaded second stage malware from compromised websites.

Moses Staff has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.

OilRig had downloaded remote files onto victim infrastructure.

Tropic Trooper has used a delivered trojan to download additional files.

Aquatic Panda has downloaded additional malware onto compromised hosts.

Ke3chang has used tools to download files to compromised machines.

Confucius has downloaded additional files and payloads onto a compromised host following initial access.

Leviathan has downloaded additional scripts and files from adversary-controlled servers.

Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.

Turla has used shellcode to download Meterpreter after compromising a victim.

TA505 has downloaded additional malware to execute on victim systems.

BITTER has downloaded additional malware and tools onto a compromised host.

APT29 has downloaded additional tools and malware onto compromised networks.

Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.

Chimera has remotely copied tools and malware onto targeted systems.

Medusa Group has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services. Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).