Procedure examples

For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.

For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.

During Salesforce Data Exfiltration, threat actors created malicious applications within Salesforce trial accounts, typically Python scripts with similar function to the Salesforce Data Loader.

For Outer Space, OilRig created new implants including the Solar backdoor.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

During the 2025 Poland Wiper Attacks, the adversaries observed that their malware was initially detected by the victims EDR solutions, so they modified the payload and attempted to execute the new version within the same day.

For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.

Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.

During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.

For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.

During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.

During the J-magic Campaign, threat actors used self-signed certificates on VPS C2 infrastructure.

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.

For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to research exploitation techniques for an identified SSRF vulnerability, to generate a tailored custom attack payload, and to develop a full exploit chain prior to deployment.

For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.

During the J-magic Campaign campaign, threat actors used open-source malware post-compromise including a custom variant of the cd00r backdoor.

For C0015, the threat actors used Cobalt Strike and Conti ransomware.

For FunnyDream, the threat actors used a new backdoor named FunnyDream.

During Night Dragon, threat actors used Trojans from underground hacker websites.

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.

During SharePoint ToolShell Exploitation, threat actors leveraged tools including Impacket, PsExec, and Mimikatz.

For Frankenstein, the threat actors obtained and used Empire.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.

In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.

For Operation Spalax, the threat actors obtained packers such as CyaX.

During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.

For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.

During ShadowRay, threat actors used tools including the XMRig miner and Interactsh.

During the Anthropic AI-orchestrated Campaign, the adversary obtained open-source penetration testing tools including network scanners, database exploitation frameworks, password crackers, and binary analysis suites.

For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.

During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.

During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.

SPACEHOP Activity leverages a C2 framework sourced from a publicly-available Github repository for administration of relay nodes.

During Operation AkaiRyū, MirrorFace deployed multiple publicly available tools including PuTTY, FRP, and Rubeus.

For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.

For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.

During Salesforce Data Exfiltration, threat actors initially relied on the legitimate Salesforce Data Loader app for data exfiltration.

For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.

During Night Dragon, threat actors obtained and used tools such as gsecdump.

For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.

For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.

During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.

During CostaRicto, the threat actors obtained open source tools to use in their operations.

During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.

During HomeLand Justice, threat actors used tools with legitimate code signing certificates.