Procedure examples

GlassWorm has spread through Visual Studio extensions. GlassWorm has also spread through JavaScript projects hosted on Github.

Shai-Hulud has published itself on compromised code repository maintainers within infected packages in attempts to propagate to other victims. Shai-Hulud has also modified versions of code packages.

XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.

Mini Shai-Hulud has published itself on compromised victim code repositories to propagate malicious versions of packages to other victims.

CanisterWorm has spread through an automated process that infects and publishes npm packages.

CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.

GoldenSpy has been packaged with a legitimate tax preparation software.

SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.

ProLock can use BITS jobs to download its malicious payload.

UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.

MarkiRAT can use BITS Utility to connect with the C2 server.

Bazar has been downloaded via Windows BITS functionality.

Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.

Egregor has used BITSadmin to download and execute malicious DLLs.

A JPIN variant downloads the backdoor payload via the BITS service.

BITSAdmin can be used to create BITS Jobs to launch a malicious process.

Kwampirs collects password policy information with the command net accounts.

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.

PoshC2 can use Get-PassPol to enumerate the domain password policy.

CrackMapExec can discover the password policies applied to the target system.

Revenge RAT uses the Forfiles utility to execute commands on the system.

Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.

VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers.

HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.

Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.

Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.

InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.

DealersChoice leverages vulnerable versions of Flash to perform execution.

XLoader has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.

SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.

Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.

EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.

SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).

Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.

Raspberry Robin execution can rely on users directly interacting with malicious LNK files.

Lumma Stealer has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.

Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.

ROAMINGHOUSE has been executed through luring victims into clicking links to download malicious ZIP files.

NETWIRE has been executed through convincing victims into clicking malicious links.

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

Gootloader has been executed through malicious links presented to users as internet search results.

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.

Snip3 has been executed through luring victims into clicking malicious links.

GuLoader has relied upon users clicking on links to malicious documents.

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.

SpicyOmelette has been executed through malicious links within spearphishing emails.