Procedure examples

Havij is used to automate SQL injection.

TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.

ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure. ShinyHunters has exploited known vulnerabilities in internet-facing servers.

Sandworm Team staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.

OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities.

Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.

Lumma Stealer has been delivered through cracked software downloads.

Raccoon Stealer has been distributed through cracked software downloads.

Tsundere Botnet has used the Node Package Manager (npm) to download malicious packages and to deliver the payload.

BeaverTail has been hosted on code repositories and disseminated to victims through NPM packages.

GlassWorm has spread through Visual Studio extensions. GlassWorm has also spread through JavaScript projects hosted on Github.

Shai-Hulud has published itself on compromised code repository maintainers within infected packages in attempts to propagate to other victims. Shai-Hulud has also modified versions of code packages.

XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.

Mini Shai-Hulud has published itself on compromised victim code repositories to propagate malicious versions of packages to other victims.

CanisterWorm has spread through an automated process that infects and publishes npm packages.

TeamPCP has conducted coordinated supply chain attacks targeting open-source developer infrastructure including the NPM, VS Code, Docker, and PyPi ecosystems to compromise multiple software packages.

ShinyHunters has compromised CI/CD pipelines by gaining access to high privilege engineering accounts on Git version control, BrowserStack, JFrog and other cloud project management platforms.

During the 3CX Supply Chain Attack, AppleJeus first compromised an “end-of-life" trading software application which was downloaded and executed inside the 3CX enterprise environment. The second compromise modified the Windows and macOS build environments used to distribute the 3CX software to their customer base.

During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.

Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.

FIN7 has gained initial access by compromising a victim's software supply chain.

Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.

GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.

Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.

Moonstone Sleet has distributed a trojanized version of PuTTY software for initial access to victims.

Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.

CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.

GoldenSpy has been packaged with a legitimate tax preparation software.

SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.

Patchwork has used BITS jobs to download malicious payloads.

APT41 used BITSAdmin to download and install payloads.

APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.

Leviathan has used BITSAdmin to download additional tools.

Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.

ProLock can use BITS jobs to download its malicious payload.

UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.

MarkiRAT can use BITS Utility to connect with the C2 server.

Bazar has been downloaded via Windows BITS functionality.

Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.

Egregor has used BITSadmin to download and execute malicious DLLs.

A JPIN variant downloads the backdoor payload via the BITS service.

BITSAdmin can be used to create BITS Jobs to launch a malicious process.

During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

HAFNIUM has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization. Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.

Sea Turtle targeted third-party entities in trusted relationships with primary targets to ultimately achieve access at primary targets. Entities targeted included DNS registrars, telecommunication companies, and internet service providers.

POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.