Procedure examples

During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.

During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.

APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.

Versa Director Zero Day Exploitation resulted in the deployment of the VersaMem web shell for follow-on activity.

During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.

During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.

During SharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.

During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.

During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.

During Operation Wocao, threat actors collected a list of installed software on the infected system.

KV Botnet Activity involved removal of security tools, as well as other identified IOT malware, from compromised devices.

During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.

During Operation Wocao, threat actors used scripts to detect security software.

Leviathan abused access to compromised appliances to collect JSON Web Tokens (JWTs), used for creating virtual desktop sessions, during Leviathan Australian Intrusions.

During the 2025 Poland Wiper Attacks, the adversaries forced victim devices to reboot to finalize destruction of impacted systems.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to download targeted data from SharePoint, and Teams.

During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.

During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.

During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.

During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the `WantedBy=multi-user.target` configuration to run GOGETTER when the system begins accepting user logins.

During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.

During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code.

During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.

During the 3CX Supply Chain Attack, AppleJeus installs a Launch Daemon to execute the POOLRAT macOS backdoor software.

KV Botnet Activity involves managing events on victim systems via libevent to execute a callback function when any running process contains the following references in their path without also having a reference to bioset: busybox, wget, curl, tftp, telnetd, or lua. If the bioset string is not found, the related process is terminated.

During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.

During the SolarWinds Compromise, APT29 used a WMI event filter to invoke a command-line event consumer at system boot time to launch a backdoor with `rundll32.exe`.

During ShadowRay, threat actors executed commands on interactive and reverse shells.

During the C0032 campaign, TEMP.Veles modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.

During the 3CX Supply Chain Attack, AppleJeus added a malicious .dylib file to a .dmg installer package for the macOS 3CX application.

During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.

Mustang Panda used Run registry keys with names such as `OneNote Update` to execute legitimate executables that would load through search-order hijacking malicious DLLS to ensure persistence during RedDelta Modified PlugX Infection Chain Operations.

During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.

During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.

During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.

During the SolarWinds Compromise, APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.

During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.

During Operation Digital Eye, threat actors used a pass-the-hash capability to move laterally.

During the 2025 Poland Wiper Attacks, the adversaries attempted to reuse password hash values to gain access to other systems.

During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.

During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.

Leviathan gathered credentials hardcoded in binaries located on victim devices during Leviathan Australian Intrusions.

During SharePoint ToolShell Exploitation, threat actors accessed web.config and machine.config to extract MachineKey values, enabling them to forge legitimate VIEWSTATE tokens for future deserialization payloads.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to extract authentication certificates stored in system configuration files across compromised environments.

Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.