Procedure examples

SMOKEDHAM has added user accounts to local Admin groups.

ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.

The `net localgroup` and `net group` commands in Net can be used to add existing users to local and domain groups.

During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.

APT41 DUST used compromised Google Workspace accounts for command and control.

During C0017, APT41 used the Cloudflare services for C2 communications.

During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.

EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.

APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.

FIN6 has used Pastebin and Google Storage to host content for their operations.

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

TeamTNT has leveraged iplogger.org to send collected data back to C2.

Mustang Panda has used DropBox URLs to deliver variants of PlugX. Mustang Panda has also used Google Drive to host malicious downloads.

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.

RedCurl has used web services to download malicious files.

LazyScripter has used GitHub to host its payloads to operate spam campaigns.

APT42 has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.

Fox Kitten has used Amazon Web Services to host C2.

Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.

VOID MANTICORE has utilized Telegram API for C2.

FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

Bumblebee has been downloaded to victim's machines from OneDrive.

BRICKSTORM has leveraged DNS web services to resolve C2 IP addresses including sslip.io and nip.io. BRICKSTORM has also utilized Cloudflare Workers for C2 communications.

SharpStage has used a legitimate web service for evading detection.

NETWIRE has used web services including Paste.ee to host payloads.

BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.

DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.

ShrinkLocker uses a subdomain on the legitimate Cloudflare resource "trycloudflare[.]com" to obfuscate the threat actor's actual address and to tunnel information sent from victim systems.

Hildegard has downloaded scripts from GitHub.

Snip3 can download additional payloads from web services including Pastebin and top4top.

GuLoader has the ability to download malware from Google Drive.

WhisperGate can download additional payloads hosted on a Discord channel.

Raspberry Robin second stage payloads can be hosted as RAR files, containing a malicious EXE and DLL, on Discord servers.

Doki has used the dogechain.info API to generate a C2 address.

Nightdoor can utilize Microsoft OneDrive or Google Drive for command and control purposes.

CHIMNEYSWEEP has the ability to use use Telegram channels to return a list of commands to be executed, to download additional payloads, or to create a reverse shell.

SocGholish has used Amazon Web Services to host second-stage servers.

DarkTortilla can retrieve its primary payload from public sites such as Pastebin and Textbin.

PureCrypter can use Telegram or Discord to send infection status messages.

Latrodectus has used Google Firebase to download malicious installation scripts.

CharmPower can download additional modules from actor-controlled Amazon S3 buckets.

SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.

RedLine Stealer has leveraged legitimate file sharing web services to host malicious payloads.

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.

Bazar downloads have been hosted on Google Docs.

Carbon can use Pastebin to receive C2 commands.

AshTag can download malicious payloads from file sharing services.

MOPSLED can use third-party web services such as GitHub and Google Drive for C2.

BoomBox can download files from Dropbox using a hardcoded access token.