Procedure examples

RedCurl has gained access to a contractor to pivot to the victim’s infrastructure.

APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.

Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.

GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.

LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.

VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.

DarkVishnya physically connected Bash Bunny, Raspberry Pi, netbooks, and inexpensive laptops to the target organization's environment to access the company’s local network.

During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.

OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.

Turla has used net accounts and net accounts /domain to acquire password policy information.

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.

Kwampirs collects password policy information with the command net accounts.

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.

PoshC2 can use Get-PassPol to enumerate the domain password policy.

CrackMapExec can discover the password policies applied to the target system.

RedCurl has used pcalua.exe to obfuscate binary execution and remote connections.

Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.

Revenge RAT uses the Forfiles utility to execute commands on the system.

Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.

During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.

Mustang Panda used the GrimResource exploitation technique via specially crafted MSC files for arbitrary code execution during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 exploited CVE-2025-21590 to bypass Veriexec protections in Junos OS designed to prevent unauthorized binary execution.

During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.

During the 3CX Supply Chain Attack, AppleJeus leveraged the Chrome vulnerability, CVE-2022-0609, in combination with a Drive-by Compromise website.

Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.

APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.

EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.

admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.

Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.

Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).

Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.

Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.

Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.

UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.

Higaisa has exploited CVE-2018-0798 for execution.

Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.

Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.

TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.

Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.

Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.

Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.

BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.