Procedure examples

IronNetInjector has the ability to decrypt embedded .NET and PE payloads.

Expand can be used to decompress a local or remote CAB file into an executable.

TeamPCP Cloud Stealer can deobfuscate an encoded Python script prior to execution.

Mini Shai-Hulud has the ability to decrypt obfuscated payloads.

CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.

BADFLICK can decode shellcode using a custom rotating XOR cipher.

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.

TRANSLATEXT has the ability to capture credentials, cookies, browser screenshots, etc. and to exfiltrate data.

Mispadu utilizes malicious Google Chrome browser extensions to steal financial data.

Lumma Stealer has installed a malicious browser extension to target Google Chrome, Microsoft Edge, Opera and Brave browsers for the purpose of stealing data.

Bundlore can install malicious browser extensions that are used to hijack user searches.

Grandoreiro can use malicious browser extensions to steal cookies and other user information.

OSX/Shlayer can install malicious Safari browser extensions to serve ads.

Mustang Panda has leveraged Visual Studio Code’s (VSCode) embedded reverse shell feature using the command `code.exe tunnel` to execute code and deliver additional payloads.

TeamPCP has compromised VS Code and Open VSX IDE extensions.

Kimsuky has the ability to use form-grabbing to extract emails and passwords from web data forms.

TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.

Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).

TRANSLATEXT has the ability to use form-grabbing and event-listening to extract data from web data forms.

IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials. IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.

Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

XLoader can conduct form grabbing, steal cookies, and extract data from HTTP sessions.

Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Carberp has captured credentials when a user performs login through a SSL session.

Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.

QakBot can use advanced web injects to steal web banking credentials.

Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.

evilginx2 can inject custom POST arguments into requests to silently enable "Remember Me" options during authentication to stay logged in across browser sessions.

Kali365 has gathered browser session information and allows affiliate threat actors to replay stolen browser sessions within their own environment.

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.

DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.

EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.

During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.

During the 3CX Supply Chain Attack, AppleJeus compromised the `www.tradingtechnologies[.]com` website hosting a hidden IFRAME to exploit visitors, two months before the site was known to deliver a compromised version of the X_TRADER software package.

During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.

APT38 has conducted watering holes schemes to gain initial access to victims.

Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

Patchwork has used watering holes to deliver files with exploits to initial victims.

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

APT32 has infected victims by tricking them into visiting compromised watering hole websites.

Leafminer has infected victims using watering holes.

Machete has distributed Machete through a fake blog website.

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

Windigo has distributed Windows malware via drive-by downloads.

Leviathan has infected victims using watering holes.