Procedure examples

AADInternals can check for the existence of user email addresses using public Microsoft APIs.

AADInternals can gather information about a tenant’s domains using public Microsoft APIs.

Shai-Hulud has the ability to search open sites and code repositories for compromised credentials. Shai-Hulud has discovered packages associated with compromised accounts. Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.

SMOKEDHAM has been delivered via malicious links in phishing emails.

evilginx2 can generate and display phishing URLs including hidden tracking pixels and can also embed URLs within iframes for browser-in-the-browser phishing.

AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.

DRYHOOK has modified the Ivanti Connect Secure VPN authentication Perl module `DSAuth.pm` by reading its contents in the buffer, then finding and replacing select lines of code.

SYNful Knock is malware that is inserted into a network device by patching the operating system image.

GlassWorm has gathered data pertaining to VPN configurations. GlassWorm has also targeted locally stored data on macOS located in `/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist`.

AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.

Shai-Hulud has published malicious gzip-compressed tarball (.tgz) following modification of packages within compromised accounts. Shai-Hulud has also modified packages within compromised accounts.

Hildegard was executed through the kubelet API run command and by executing commands on running containers.

Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.

Kinsing was executed with an Ubuntu container entry point that runs shell scripts.

Peirates can use `kubectl` or the Kubernetes API to run commands.

TeamPCP Cloud Stealer can use `kubectl get secrets` to extract credentials from Kubernetes.

Mini Shai-Hulud has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities `kubectl get secrets`.

CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.

Kinsing was run through a deployed Ubuntu container.

Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.

Doki was run through a deployed container.

Hildegard has used the BOtB tool that can break out of containers.

Doki’s container was configured to bind the host root directory.

Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.

Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.

Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.

Peirates can enumerate Kubernetes pods in a given namespace.

TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.

CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters. CanisterWorm has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.

Tsundere Botnet has checked the victim machine’s location by obtaining the culture name of the machine.

InvisibleFerret has collected the internal IP address, IP geolocation information of the infected host and sends the data to a C2 server. InvisibleFerret has also leveraged the “pay” module to obtain region name, country, city, zip code, ISP, latitude and longitude using “http://ip-api.com/json”.

Crimson can identify the geographical location of a victim host.

Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.

HexEval Loader has a function where the C2 endpoint can identify the geographical location of a victim host based on request headers, execution environment and runtime conditions.

Cuckoo Stealer can determine the geographical location of a victim host by checking the language.

SameCoin can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.

Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.

SocGholish can use IP-based geolocation to limit infections to victims in North America, Europe, and a small number of Asian-Pacific nations.

DarkWatchman can identity the OS locale of a compromised host.

PlugX has obtained the location of the victim device by leveraging `GetSystemDefaultLCID`.

PureCrypter can use `kernel32!GetGeoInfo` to determine system location.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.

GlassWorm has leveraged geofencing logic to detect whether it is operating in a Russian associated time zone to determine whether it continues to execute.

RedLine Stealer has gathered detailed information about victims’ systems, such as IP addresses, and geolocation. RedLine Stealer has also checked the IP from where it was being executed and leveraged an opensource geolocation IP-lookup service.

SDBbot can collected the country code of a compromised machine.

Raccoon Stealer collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.

AshTag can check geolocation on targeted systems.

GrimAgent can identify the country code on a compromised host.