Procedure examples

TA551 has retrieved DLLs and installer binaries for malware execution from C2.

BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.

Darkhotel has used first-stage payloads that download additional malware from C2 servers.

LazyScripter had downloaded additional tools to a compromised host.

Windshift has used tools to deploy additional payloads to compromised hosts.

Volatile Cedar can deploy additional tools.

Whitefly has the ability to download additional tools from the C2.

LuminousMoth has downloaded additional malware and tools onto a compromised host.

APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

Metador has downloaded tools and malware onto a compromised system.

Fox Kitten has downloaded additional tools including PsExec directly to endpoints.

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.

Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.

Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.

Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

Silence has downloaded additional modules and malware to victim’s machines.

Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.

Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.

Molerats used executables to download malicious files from different sources.

IndigoZebra has downloaded additional files and tools from its C2 server.

Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.

VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.

Play has used Cobalt Strike to download files to compromised machines.

HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.

Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.

Rancor has downloaded additional malware, including by using certutil.

WIRTE has downloaded PowerShell code from the C2 server to be executed.

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.

Magic Hound has downloaded additional code and files from servers onto victims.

Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .

APT33 has downloaded additional files and programs from its C2 server.

FIN8 has used remote code execution to download subsequent payloads.

FIN13 has downloaded additional tools and malware to compromised systems.

Nomadic Octopus has used malicious macros to download additional files to the victim's machine.

TeamPCP has modified legitimate software binaries to retrieve secondary payloads from C2.

ShinyHunters has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.