Procedure examples

During Night Dragon, threat actors purchased hosted services to use for C2.

For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.

During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.

For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.

During the 2025 Poland Wiper Attacks, the adversaries configured the FortiGate devices to send notifications to an attacker-controlled Slack channel. During the 2025 Poland Wiper Attacks, the adversaries had also staged tools and files on services such as Dropbox and Pastebin.

APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.

Indian Critical Infrastructure Intrusions included the use of compromised infrastructure, such as DVR and IP camera devices, for command and control purposes in ShadowPad activity.

During APT28 Nearest Neighbor Campaign, APT28 compromised third-party infrastructure in physical proximity to targets of interest for follow-on activities.

For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.

For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.

For the SolarWinds Compromise, APT29 compromised domains to use for C2.

During the 2025 Poland Wiper Attacks, the adversaries compromised infrastructure to use for C2.

During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.

During Operation MidnightEclipse, threat actors abused Virtual Private Servers to store malicious files.

During the 2025 Poland Wiper Attacks, the adversaries used compromised VPS servers for C2.

For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.

For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.

During the Anthropic AI-orchestrated Campaign, the adversary operated dedicated penetration testing servers accessible via MCP to support remote command execution, simultaneous tool coordination, and persistent operational state maintenance across campaign sessions.

During Juicy Mix, OilRig compromised an Israeli job portal to use for a C2 server.

During Outer Space, OilRig compromised an Israeli human resources site to use as a C2 server.

During Night Dragon, threat actors compromised web servers to use for C2.

Quad7 Activity has compromised various branded SOHO routers to form a botnet that has been leveraged in password spraying activity.

During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.

KV Botnet Activity focuses on compromise of small office-home office (SOHO) network devices to build the subsequent botnet.

During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.

During the 2025 Poland Wiper Attacks, the adversaries used compromised Cisco routers for network communications.

Versa Director Zero Day Exploitation used compromised small office/home office (SOHO) devices to interact with vulnerable Versa Director servers.

Quad7 Activity has compromised network devices, such as IP cameras, Network Attached Storage (NAS) devices, and SOHO routers, to leverage for follow-on activity.

FLORAHOX Activity has compromised network routers and IoT devices for the ORB network.

During Salesforce Data Exfiltration, threat actors created Salesforce trial accounts to register their malicious applications.

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.

For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.

During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.

During SharePoint ToolShell Exploitation, threat actors created Proton mail accounts for communication with organizations infected with ransomware.

During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.

For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.

During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.

For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.

During Salesforce Data Exfiltration, threat actors registered emails shinycorp@tuta[.]com and shinygroup@tuta[.]com to send victims extortion demands.

For Operation Wocao, the threat actors registered email accounts to use during the campaign.

During Operation AkaiRyū, MirrorFace established OneDrive accounts to host malicious payloads.

During Outer Space, OilRig created M365 email accounts to be used as part of C2.

During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.

During Salesforce Data Exfiltration, threat actors used compromised emails to create Salesforce trial accounts.

APT41 DUST used compromised Google Workspace accounts for command and control.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.

For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.

In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.