Procedure examples

During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.

During C0027, Scattered Spider downloaded tools using victim organization systems.

Quad7 Activity has downloaded additional binaries from a remote File Transfer Protocol (FTP) server to compromised devices.

During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.

During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.

During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.

During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.

During Operation Digital Eye, threat actors used native API such as `GetUserInfo`.

During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.

During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.

During the 2025 Poland Wiper Attacks, the adversaries attempted to crack user passwords.

During Night Dragon, threat actors used Cain & Abel to crack password hashes.

During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials.

Quad7 Activity has conducted a throttled variant of password spraying techniques that only utilized a single attempt to sign in within a 24-hour time period, eluding brute force detection thresholds.

During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.

Leviathan abused compromised appliance access to collect multifactor authentication token values during Leviathan Australian Intrusions.

During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, disabled security services via Registry modifications.

During Operation Honeybee, the threat actors used batch files that modified registry keys.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching `rundll32.exe`, which in-turn launches the malware and communicates with C2 servers over the Internet. .

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.

During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).

During the 2025 Poland Wiper Attacks, the adversaries captured screenshots of devices using nircmd console through the command nircmd.exe “savescreenshot C:\Windows\Temp\imagetmp.png.

During Night Dragon, threat actors used RAT malware to exfiltrate email archives.

During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.

During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to gather data and email messages from Exchange services related to OT topics and technical work carried out within organizations.

During Operation Wocao, threat actors collected clipboard data in plaintext.

During SharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.

During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to automatically collect and process large volumes of data from without human direction.

ArcaneDoor included collection of packet capture and system configuration information.

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.

During Operation Wocao, threat actors used a script to collect information about the infected system.

During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors discovered removable disks attached to a system.

During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.

During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.

During Frankenstein, the threat actors used MSbuild to execute an actor-created file.

During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.

During Juicy Mix, OilRig used a VBS script to send the Base64-encoded name of the compromised computer to C2.

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.

During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.

For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.

During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.

ArcaneDoor used WebVPN sessions commonly associated with Clientless SSLVPN services to communicate to compromised devices.

During the 2025 Poland Wiper Attacks, threat actors leveraged the FortiGate VPN interface that was exposed to the internet to gain access to the victim environment.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.