Procedure examples

APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.

Mustang Panda acquired Cloudflare Origin CA TLS certificates during RedDelta Modified PlugX Infection Chain Operations.

For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.

Indian Critical Infrastructure Intrusions included the use of digital certificates spoofing Microsoft.

Leviathan weaponized publicly-known vulnerabilities for initial access and other purposes during Leviathan Australian Intrusions.

During the Anthropic AI-orchestrated Campaign, the adversary obtained access to Claude Code to support cyber intrusion operations.

During the 2025 Poland Wiper Attacks, the adversaries generated custom script with an LLM.

For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.

During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.

For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.

During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.

Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations.

Quad7 Activity has gathered targeted individual’s e-mail addresses for the password spraying attempts.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map a complete network topology of the target infrastructure.

During the 2025 Poland Wiper Attacks, the adversaries obtained details on the configuration of the victim Fortinet perimeter device to include publicly disclosed details on an online forum used by criminal communities.

For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.

During Operation Digital Eye, threat actors concealed malicious activity by using terms that aligned with the technological context of the targeted organization.

During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.

During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to catalog services and data on discovered endpoints.

During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to gather details of high-value systems to include databases and workflow orchestration platforms.

For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.

APT41 DUST involved use of search engines to research victim servers.

During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.

APT41 DUST involved access of external victim websites for target development.

Leviathan enumerated compromised web application resources to identify additional endpoints and resources linkd to the website for follow-on access during Leviathan Australian Intrusions.

In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan infrastructure across IP ranges associated with the target organization.

During SharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.

During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan target infrastructure to identify potential vulnerabilities and to enumerate services and endpoints.

APT41 DUST used internet scan data for target development.

During C0027, Scattered Spider sent Telegram messages impersonating IT personnel to harvest credentials.

During Salesforce Data Exfiltration, threat actors initiated voice calls with victims to socially engineer them into authorizing malicious applications or divulging sensitive credentials.

During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.

Indian Critical Infrastructure Intrusions involved the use of FRP to bridge network boundaries and overcome NAT. Indian Critical Infrastructure Intrusions also involved the use of VPN tunnels with a potentially compromised MSP entity allowing for direct access to critical infrastructure entity networks.

During the 2025 Poland Wiper Attacks, the adversaries gathered and used the FortiGate bookmarks defined in the configuration file to include the statically defined credentials that facilitated RDP connections to jump hosts.

During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.

During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.

Mustang Panda staged malware on adversary-controlled domains and cloud storage instances during RedDelta Modified PlugX Infection Chain Operations.

For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.

For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.

For C0021, the threat actors uploaded malware to websites under their control.

For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.

During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.

For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.

During the 2025 Poland Wiper Attacks, the adversaries had staged tools and files for use on Dropbox and Pastebin.

For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.

For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.