Procedure examples

During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.

During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.

Mustang Panda used legitimate, signed binaries such as `inkform.exe` or `ExcelRepairToolboxLauncher.exe` for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.

During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.

Although the X_TRADER platform was reportedly discontinued in 2020, it was still available for download from the legitimate Trading Technologies website in 2022. During the 3CX Supply Chain Attack, AppleJeus used a code signing certificate to digitally sign the malicious software with an expiration date set to October 2022. This file was signed with the subject “Trading Technologies International, Inc” and contained the executable file Setup.exe, also signed with the same digital certificate.

For C0015, the threat actors used DLL files that had invalid certificates.

During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.

During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.

During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.

During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.

During the 2025 Poland Wiper Attacks, the adversaries configured a native CLI to gather a targeted elevated users password using `grep`.

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.

During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.

During Juicy Mix, OilRig used a Windows Credential Manager stealer for credential access.

During Operation Wocao, threat actors accessed and collected credentials from password managers.

ArcaneDoor included modification of the AAA process to bypass authentication mechanisms.

During the 2025 Poland Wiper Attacks, the adversaries modified two-factor settings within the FortiGate solution to `unset`.

ArcaneDoor included interception of HTTP traffic to victim devices to identify and parse command and control information sent to the device.

During the 2025 Poland Wiper Attacks, the adversaries used the Rubeus tool to forge a Diamond Ticket that is a modified legitimate Kerberos ticket.

During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.

During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.

Leviathan used Kerberoasting techniques during Leviathan Australian Intrusions.

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.

During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL creates and listens on a Windows named pipe to exchange messages between modules.

During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.

During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.

During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.

During Cutting Edge, threat actors saved collected data to a tar archive.

During the SolarWinds Compromise, APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfltration; APT29 also compressed text files into zipped archives.

During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.

During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.

During APT28 Nearest Neighbor Campaign, APT28 used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data.

During the 2025 Poland Wiper Attacks, the adversaries compressed stolen files into a zip file prior to exfiltration.

APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.

During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.

During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.

During C0017, APT41 hex-encoded PII data prior to exfiltration.

During APT28 Nearest Neighbor Campaign, APT28 used the native Microsoft utility cipher.exe to securely wipe files and folders – overwriting the deleted data using cmd.exe /c cipher /W:C.

During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.

Mustang Panda stored encrypted payloads associated with PlugX installation in hidden directories during RedDelta Modified PlugX Infection Chain Operations.

KV Botnet Activity leveraged a bind mount to bind itself to the `/proc/` file path before deleting its files from the `/tmp/` directory.

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.

During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.

Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.

During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.