Procedure examples

APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.

Mustang Panda has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.

Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.

Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.

It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.

ShinyHunters has abused software deployment tools for lateral movement.

Volt Typhoon has staged collected data in password-protected archives.

Scattered Spider stages data in a centralized database prior to exfiltration.

INC Ransom has staged data on compromised hosts prior to exfiltration.

Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.

QUIETCANARY has the ability to stage data prior to exfiltration.

Shark has stored information in folders named `U1` and `U2` prior to exfiltration.

Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.

Kevin can create directories to store logs and other collected data.

During SharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.

During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.

During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to stage extracted data and operational documentation in structured markdown files on local systems prior to exfiltration.

During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.

During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.

During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.

During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the C:\ProgramData directory.

During the 2025 Poland Wiper Attacks, the adversaries compiled discovery data locally on the victim host in a file located within `C:\Windows\TEMP\outlog.txt`.

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.

Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.

During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.

Indrik Spider has stored collected data in a .tmp file.

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.

APT3 has been known to stage files for exfiltration in a single location.

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\. Kimsuky has also gathered data in structured directories prior to exfiltration under the %TEMP% environment variable.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.

Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.

TeamTNT has aggregated collected credentials in text files before exfiltrating.

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

APT39 has utilized tools to aggregate data prior to exfiltration.

UNC3886 has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.

Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.

Chimera has staged stolen data locally on compromised hosts.