Procedure examples

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.

Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.

Whitefly has obtained and used tools such as Mimikatz.

LuminousMoth has obtained an ARP spoofing tool from GitHub.

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

Metador has used Microsoft's Console Debugger in some of their operations.

APT42 has used built-in features in the Microsoft 365 environment and publicly available tools to avoid detection.

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.

INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.

Earth Lusca has acquired and used a variety of open source tools.

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.

Thrip has obtained and used tools such as Mimikatz and PsExec.

LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.

Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.

CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.

Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.

Inception has obtained and used open-source tools such as LaZagne.

VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.

Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.

WIRTE has obtained and used Empire and Rclone for post-exploitation activities.

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.

FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.

FIN8 has used open-source tools such as Impacket for targeting efforts.

FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.

APT19 has obtained and used publicly-available tools like Empire.

PittyTiger has obtained and used tools such as Mimikatz and gsecdump.

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.