Procedure examples

KONNI had a feature to steal data from the clipboard.

A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.

Catchamas steals data stored in the clipboard.

Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.

RTM collects data from the clipboard.

Grandoreiro can capture clipboard data from a compromised host.

XLoader can collect data stored in the victim's clipboard.

MgBot can capture clipboard data.

Cadelspy has the ability to steal data from the clipboard.

TajMahal has the ability to steal data from the clipboard of an infected host.

TinyZBot contains functionality to collect information from the clipboard.

Melcoz can monitor content saved to the clipboard.

Agent Tesla can steal data from the victim’s clipboard.

Remexi collects text from the clipboard.

Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.

jRAT can capture clipboard data.

The executable version of Helminth has a module to log clipboard contents.

MacSpy can steal clipboard contents.

SILENTTRINITY can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText()` to collect data from the clipboard.

Empire can harvest clipboard data on both Windows and macOS systems.

Remcos steals and modifies data from the clipboard.

Koadic can retrieve the current content of the user clipboard.

During SharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.

During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to automatically collect and process large volumes of data from without human direction.

ArcaneDoor included collection of packet capture and system configuration information.

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.

During Operation Wocao, threat actors used a script to collect information about the infected system.

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.

menuPass has used the Csvde tool to collect Active Directory files and data.

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Sidewinder has used tools to automatically collect system and network configuration information.

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

OilRig has used automated collection.

Tropic Trooper has collected information automatically using the adversary's USBferry attack.

Ke3chang has performed frequent and scheduled data collection from victim networks.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

RedCurl has used batch scripts to collect data.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Chimera has used custom DLLs for continuous retrieval of data from memory.

Ember Bear engages in mass collection from compromised systems during intrusions.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Proxysvc automatically collects data about the victim and sends it to the control server.