Procedure examples

Leviathan has exfiltrated data over its C2 channel.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.

Chimera has used Cobalt Strike C2 beacons for data exfiltration.

LuminousMoth has used malware that exfiltrates stolen data to its C2 server.

Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.

WIRTE has exfiltrated collected victim data to C2 infrastructure.

BlackByte has used tools such as NetScan to enumerate network services in victim environments.

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.

Naikon has used the LadonGo scanner to scan target networks.

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.

Leafminer scanned network services to search for vulnerabilities in the victim system.

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.

Mustang Panda has leveraged NBTscan to scan IP networks.

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.

Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.

BlackTech has used the SNScan tool to find other potential targets on victim networks.

DarkVishnya performed port scanning to obtain the list of active services.

RedCurl has used netstat to check if port 4119 is open.

Lotus Blossom has used port scanners to enumerate services on remote hosts.

Chimera has used the get -b <start ip> -e <end ip> -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.

Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration. Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services.

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.

INC Ransom has used NETSCAN.EXE for internal reconnaissance.

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.

FIN13 has utilized `nmap` for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.

Indrik Spider has used WMIC to execute commands on remote computers.

BlackByte used WMI to delete Volume Shadow Copies on victim machines.

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

Naikon has used WMIC.exe for lateral movement.