Procedure examples

BlackByte masqueraded configuration files containing encryption keys as PNG files.

Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.

Mustang Panda has masqueraded malicious executables as legitimate files that download PlugX malware.

MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.

APT3 has been known to create or enable accounts, such as support_388945a0.

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.

Storm-1811 has created Microsoft Teams accounts that spoof IT support and helpdesk members for use in application and voice phishing.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

APT41 used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` rootkit.

Rocke has installed an "init.d" startup script to maintain persistence.

UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config `/etc/init.d/localnet` within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.

APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.

An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.

UNC3886 has placed a bash installation script into `/etc/rc.local.d/` to establish persistence.

APT29 has installed a run command on a compromised system to enable malware execution on system startup.

Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence.

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

RedCurl has collected data about network drives.

Chimera has collected data of interest from network shares.

BRONZE BUTLER has exfiltrated files stolen from file shares.

APT28 has collected files from network shared drives.

Fox Kitten has searched network shares to access sensitive documents.

Sowbug extracted Word documents from a file server on a victim network.

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.

Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.

Sandworm Team has used intercepter-NG to sniff passwords in network traffic.

UNC3886 has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.

DarkVishnya used network sniffing to obtain login data.

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.

Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.

APT33 has used SniffPass to collect credentials by sniffing network traffic.

BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.

GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.

APT3 has a tool that exfiltrates data over the C2 channel.

Kimsuky has exfiltrated data over its C2 channel.

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

MuddyWater has used C2 infrastructure to receive exfiltrated data.

A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Sandworm Team has sent system information to its C2 server using HTTP.

CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.

Mustang Panda has exfiltrated stolen data and files to its C2 server.

ZIRCONIUM has exfiltrated files via the Dropbox API C2.

Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.

APT39 has exfiltrated stolen victim data through C2 communications.

Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.

Higaisa exfiltrated data over its C2 channel.

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Confucius has exfiltrated stolen files to its C2 server.