Procedure examples

SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.

TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.

During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.

During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.

FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.

Sea Turtle staged collected email archives in the public web directory of a website that was accessible from the internet.

Leviathan has staged data remotely prior to exfiltration.

MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.

Chimera has staged stolen data on designated servers in the target environment.

MirrorFace has gathered data and files of interest on a single victim machine.

ToddyCat manually transferred collected files to an exfiltration host using xcopy.

APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.

FIN8 aggregates staged data from a network into a single location.

ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.

During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.

During 3CX Supply Chain Attack, AppleJeus has gained access to the 3CX corporate environment through legitimate VPN credentials.

During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks.

During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.

During the C0032 campaign, TEMP.Veles used compromised VPN accounts.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Operation Wocao, threat actors used valid VPN credentials to gain initial access.

Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions.

Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.

BlackByte has gained access to victim environments through legitimate VPN credentials.

GALLIUM leveraged valid accounts to maintain access to a victim network.

Volt Typhoon relies primarily on valid credentials for persistence.

APT41 used compromised credentials to log on to other systems.

Dragonfly has compromised user credentials and used valid accounts for operations.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.

FIN7 has harvested valid administrative credentials for lateral movement.

Sandworm Team have used previously acquired legitimate credentials prior to attacks.

APT18 actors leverage legitimate credentials to log into external remote services.

Scattered Spider has used compromised credentials for initial access.

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).

UNC3886 has used tools to hijack valid SSH accounts.

Akira uses valid account information to remotely access victim networks, such as VPN credentials.

OilRig has used compromised credentials to access other systems on a victim network.

Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.

Sea Turtle used compromised credentials to maintain long-term access to victim environments.

Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.

POLONIUM has used valid compromised credentials to gain access to victim environments.

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.