Procedure examples

Remcos has full control of the Registry, including the ability to modify it.

CrackMapExec can create a registry key using wdigest.

Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.

QuasarRAT has a command to edit the Registry on the victim’s machine.

During the 2025 Poland Wiper Attacks, the adversaries captured screenshots of devices using nircmd console through the command nircmd.exe “savescreenshot C:\Windows\Temp\imagetmp.png.

Kimsuky has captured browser screenshots using TRANSLATEXT. Kimsuky has also obtained screen captures with custom malware.

Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

MuddyWater has used malware that can capture screenshots of the victim’s machine.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

FIN7 captured screenshots and desktop video recordings.

APT39 has used a screen capture utility to take screenshots on a compromised host.

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

MoustachedBouncer has used plugins to take screenshots on targeted systems.

Malware used by Group5 is capable of watching the victim's screen.

Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.

Dark Caracal took screenshots using their Windows malware.

BRONZE BUTLER has used a tool to capture screenshots.

APT28 has used tools to take screenshots from victims.

APT42 has used malware, such as GHAMBAR and POWERPOST, to take screenshots.

GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.

Silence can capture victim screen activity.

VOID MANTICORE has captured screen content during an active Zoom session.

Magic Hound malware can take a screenshot and upload the file to its C2 server.

RCSession can capture screenshots from a compromised host.

QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.

GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.

yty collects screenshots of the victim machine.

DOGCALL is capable of capturing screenshots of the victim's machine.

POWRUNER can capture a screenshot from a victim.

SharpStage has the ability to capture the victim's screen.

HALFBAKED can obtain screenshots from the victim.

KEYMARBLE can capture screenshots of the victim’s machine.

Ursnif has used hooked APIs to take screenshots.

ZLib has the ability to obtain screenshots of the compromised system.

RedLeaves can capture screenshots.

Zeus Panda can take screenshots of the victim’s machine.

Havoc can capture screenshots.

Matryoshka is capable of performing screen captures.

Janicab captured screenshots and sent them out to a C2 server.

TONESHELL has conducted screen capturing.

Kasidet has the ability to initiate keylogging and screen captures.

RainyDay has the ability to capture screenshots.

AppleSeed can take screenshots on a compromised host by calling a series of APIs.

NETWIRE can capture the victim's screen.

CosmicDuke takes periodic screenshots and exfiltrates them.

EvilGrab has the capability to capture screenshots.

Aria-body has the ability to capture screenshots on compromised hosts.

Crimson contains a command to perform screen captures.

DUSTTRAP can capture screenshots.