Procedure examples

AADInternals can steal users’ access tokens via phishing emails containing malicious links.

TruffleHog has gathered access tokens and API tokens from CI/CD pipeline solutions and repositories.

Peirates gathers Kubernetes service account tokens using a variety of techniques.

TeamPCP Cloud Stealer can read runner.worker process memory to extract plaintext tokens.

Mini Shai-Hulud has stolen application access tokens and other tokens to include those associated with CI/CD.

CanisterWorm has gathered cloud access tokens.

Kali365 has obtained OAuth access and refresh tokens by deceiving victims into completing actor-initiated device authorization requests, and intercepting authentication sessions with legitimate identity providers through adversary-in-the-middle reverse proxy infrastructure.

AcidRain reboots the target system once the various wiping processes are complete.

AvosLocker’s Linux variant has terminated ESXi virtual machines.

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

DynoWiper has used the Microsoft Windows native `ExitWindowsEx()` function to log off the interactive user and shutdown the system.

ShrinkLocker can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.

Apostle reboots the victim machine following wiping and related activity.

WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.

AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain.

CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.

DCSrv has a function to sleep for two hours before rebooting the system.

NotPetya will reboot the system one hour after infection.

LockerGoga has been observed shutting down infected systems.

MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.

DarkGate has used the `shutdown`command to shut down and/or restart the victim system.

Latrodectus has the ability to restart compromised hosts.

Shamoon will reboot the infected system once the wiping functionality has been completed.

Black Basta has used `ShellExecuteA` to shut down and restart the victim system.

XLoader can initiate a system reboot or shutdown.

HermeticWiper can initiate a system shutdown.

LookBack can shutdown and reboot the victim machine.

BFG Agonizer uses elevated privileges to call NtRaiseHardError to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.

Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

KillDisk attempts to reboot the machine by terminating specific processes.

Qilin can initiate a reboot of the backup server to hinder recovery.

Remcos can shutdown and restart remote devices.

CanisterWorm has forced the target system to reboot after file deletion.

Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.

AADInternals can collect files from a user’s OneDrive.

TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.

Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.

LockerGoga has been observed changing account passwords and logging off current users.

MegaCortex has changed user account passwords and logged users off the system.

Meteor has the ability to change the password of local users on compromised hosts and can log off users.

DEADWOOD changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.

SameCoin can send its Setup.exe file as an attachment to other addresses in the same compromised organization.

TRANSLATEXT has exfiltrated updated cookies from Google, Naver, Kakao or Daum to the C2 server.

Lumma Stealer has harvested cookies from various browsers.

DarkGate attempts to steal Opera cookies, if present, after terminating the related process.

Chaes has used a script that extracts the web session cookie and sends it to the C2 server.

LODEINFO can list the contents of `%LocalAppData%\Google\Chrome\User Data\` and `%LocalAppData%\Microsoft\Edge\User Data\` to obtain cookies.

EVILNUM can harvest cookies and upload them to the C2 server.

GlassWorm has harvested Safari cookies stored within `/Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies`. GlassWorm has also stolen cookies within Chromium and Firefox browsers.

Spica has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.