Procedure examples

Agent Tesla can capture screenshots of the victim’s desktop.

POWERSTATS can retrieve screenshots from compromised hosts.

ECCENTRICBANDWAGON can capture screenshots and store them locally.

BADNEWS has a command to take a screenshot and send it to the C2 server.

Remexi takes screenshots of windows of interest.

jRAT has the capability to take screenshots of the victim’s machine.

MacSpy can capture screenshots of the desktop over multiple monitors.

Lizar can take JPEG screenshots of an infected system. Lizar has also used a plugin to take a screenshot of the infected system.

Azorult can capture screenshots of the victim’s machines.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

StrifeWater has the ability to take screen captures.

SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.

RemoteUtilities can take screenshots on a compromised host.

Sliver can take screenshots of the victim’s active display.

SILENTTRINITY can take a screenshot of the current desktop.

PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.

Empire is capable of capturing screenshots on Windows and macOS systems.

PcShare can take screen shots of a compromised machine.

AsyncRAT has the ability to view the screen on compromised hosts.

Brute Ratel C4 can take screenshots on compromised hosts.

Remcos takes automated screenshots of the infected machine.

ConnectWise can take screenshots on remote hosts.

Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.

Quick Assist allows for the remote administrator to take screenshots of the running system.

Flame can take regular screenshots when certain applications are open that are sent to the command and control server.

Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.

Silent Librarian has exfiltrated entire mailboxes from compromised accounts.

Ember Bear attempts to collect mail from accessed systems and servers.

Magic Hound has compromised email credentials in order to steal sensitive data.

Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

TRANSLATEXT has exfiltrated collected email addresses to the C2 server.

During Night Dragon, threat actors used RAT malware to exfiltrate email archives.

Sea Turtle collected email archives from victim environments.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.

Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.

RedCurl has collected emails to use in future phishing campaigns.

Chimera has harvested data from victim's e-mail including through execution of wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy.

MirrorFace has exfiltrated stored emails from compromised hosts.

WIRTE has collected documents from victims' email accounts.

Magic Hound has collected .PST archives.

Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).

CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.

Emotet has been observed leveraging a module that scrapes email data from Outlook.

Crimson contains a command to collect and exfiltrate emails from Outlook.

Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.

KGH_SPY can harvest data from mail clients.

LunarMail can capture the recipients of sent email messages from compromised accounts.

QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.

Empire has the ability to collect emails on a target system.

Out1 can parse e-mails on a target machine.