Procedure examples

T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.

SDBbot has the ability to record video on a compromised host.

Derusbi is capable of capturing video.

Cobian RAT has a feature to access the webcam on the victim’s machine.

NanoCore can access the victim's webcam and capture data.

TajMahal has the ability to capture webcam video.

Revenge RAT has the ability to access the webcam.

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.

ZxShell has a command to perform video device spying.

njRAT can access the victim's webcam.

Agent Tesla can access the victim’s webcam and record video.

jRAT has the capability to capture video from a webcam.

WarzoneRAT can access the webcam on a victim's machine.

Empire can capture webcam data on Windows and macOS systems.

PcShare can capture camera video as part of its collection process.

AsyncRAT can record screen content on targeted systems.

Remcos can access a system’s webcam and take pictures.

ConnectWise can record video on remote hosts.

Imminent Monitor has a remote webcam monitoring capability.

Pupy can access a connected webcam and capture pictures.

QuasarRAT can perform webcam viewing.

Quick Assist allows for the remote administrator to view the interactive session of the running machine, including full screen activity.

During Frankenstein, the threat actors used MSbuild to execute an actor-created file.

During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.

A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.

NOOPLDR can be executed via MSBuild.

Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.

Mustang Panda has leveraged `LoadLibrary` to load DLLs.

BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.

Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.

Stuxnet calls LoadLibrary then executes exports from a DLL.

RotaJakiro uses dynamically linked shared libraries (`.so` files) to execute additional functionality using `dlopen()` and `dlsym()`.

VersaMem relied on the Java Instrumentation API and Javassist to dynamically modify Java code existing in memory.

BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.

LightSpy's main executable and module `.dylib` binaries are loaded using a combination of `dlopen()` to load the library, `_objc_getClass()` to retrieve the class definition, and `_objec_msgSend()` to invoke/execute the specified method in the loaded class.

PUNCHBUGGY can load a DLL using the LoadLibrary API.

DarkWatchman can load DLLs.

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.

Metamorfo had used AutoIt to load and execute the DLL payload.

PipeMon has used call to LoadLibrary to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.

gh0st RAT can load DLLs into memory.

Attor's dispatcher can execute additional plugins by loading the respective DLLs.

For network communications, OSX_OCEANLOTUS.D loads a dynamic library (`.dylib` file) using `dlopen()` and obtains a function pointer to execute within that shared library using `dlsym()`.

TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.

Ebury is executed through hooking the keyutils.so file used by legitimate versions of `OpenSSH` and `libcurl`.

KillDisk loads and executes functions from a DLL.

Astaroth uses the LoadLibraryExW() function to load additional modules.

Dtrack contains a function that calls LoadLibrary and GetProcAddress.

Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.