Procedure examples

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

Dragonfly has copied and installed tools for operations once in the victim environment.

Evilnum can deploy additional components or tools as needed.

Gorgon Group malware can download additional files from C2 servers.

menuPass has installed updates and new malware on victims.

APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.

MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.

Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.

Storm-1811 has used scripted `cURL` commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

APT18 can upload a file to the victim’s machine.

Andariel has downloaded additional tools and malware onto compromised hosts.

Sidewinder has used LNK files to download remote files to the victim's network.

Mustang Panda has downloaded additional executables following the initial infection stage. Mustang Panda has also leveraged Visual Studio Code `code.exe` and Dev Tunnels using `DevTunnel.exe` to propagate additional tools and payloads.

ZIRCONIUM has used tools to download malicious files to compromised hosts.

Rocke used malware to download additional malicious files to the target system.

Scattered Spider has downloaded the Teleport remote access tool to compromised VMware vCenter Servers.

APT39 has downloaded tools to compromised hosts.

TA2541 has used malicious scripts and macros with the ability to download additional payloads.

APT37 has downloaded second stage malware from compromised websites.

Moses Staff has downloaded and installed web shells to following path C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx.

OilRig had downloaded remote files onto victim infrastructure.

Tropic Trooper has used a delivered trojan to download additional files.

Aquatic Panda has downloaded additional malware onto compromised hosts.

Ke3chang has used tools to download files to compromised machines.

Confucius has downloaded additional files and payloads onto a compromised host following initial access.

Leviathan has downloaded additional scripts and files from adversary-controlled servers.

Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.

Turla has used shellcode to download Meterpreter after compromising a victim.

TA505 has downloaded additional malware to execute on victim systems.

BITTER has downloaded additional malware and tools onto a compromised host.

APT29 has downloaded additional tools and malware onto compromised networks.

Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.

Chimera has remotely copied tools and malware onto targeted systems.

Medusa Group has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services. Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).

TA551 has retrieved DLLs and installer binaries for malware execution from C2.

BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.

Darkhotel has used first-stage payloads that download additional malware from C2 servers.

LazyScripter had downloaded additional tools to a compromised host.

Windshift has used tools to deploy additional payloads to compromised hosts.

Volatile Cedar can deploy additional tools.

Whitefly has the ability to download additional tools from the C2.

LuminousMoth has downloaded additional malware and tools onto a compromised host.

APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

Metador has downloaded tools and malware onto a compromised system.

Fox Kitten has downloaded additional tools including PsExec directly to endpoints.