Procedure examples

Disco has been executed through inducing user interaction with malicious .zip and .msi files.

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Qilin has been delivered to victims through spearphishing emails with malicious attachments.

AppleJeus has required user execution of a malicious MSI installer.

STARWHALE has relied on victims opening a malicious Excel file for execution.

Agent Tesla has been executed through malicious e-mail attachments

Astaroth has used malicious files including VBS, LNK, and HTML for execution.

QakBot has gained execution through users opening malicious attachments.

SYSCON has been executed by luring victims to open malicious e-mail attachments.

Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.

Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.

OSX/Shlayer has relied on users mounting and executing a malicious DMG file.

JSS Loader has been executed through malicious attachments contained in spearphishing emails.

WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.

CSPY Downloader has been delivered via malicious documents with embedded macros.

CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.

AsyncRAT has been executed through victims opening malicious file attachments.

Brute Ratel C4 has gained execution through users opening malicious documents.

Remcos has been executed by luring victims into opening malicious email attachments including Excel files.

BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.

TeamTNT has relied on users to download and execute malicious Docker images.

Kimsuky has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.

Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

The Havoc infection chain has been initiated via ClickFix lures in phishing emails.

Kali365 has dynamically generated legitimate device codes that displays on the victims screen alongside instructions to copy and paste the device code to initiate and complete a successful authentication process.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

During RedPenguin, UNC3886 leveraged malware capable of inpecting packets for a magic-string to activate backdoor functionalities.

During Cutting Edge, threat actors sent a magic 48-byte sequence to enable the PITSOCK backdoor to communicate via the `/tmp/clientsDownload.sock` socket.

Kimsuky has used TRANSLATEXT to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

Mustang Panda has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.

UNC3886 has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.

TONESHELL has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.

BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.

J-magic can monitor TCP traffic for packets containing one of five different predefined parameters and will spawn a reverse shell if one of the parameters and the proper response string to a subsequent challenge is received.

PUBLOAD has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of 17 03 03. PUBLOAD has also used magic bytes consisting of 46 77 4d.

Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.

TRANSLATEXT has redirected clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

The REPTILE reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.

Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.

Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.

SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.

Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.

Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.

Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.

Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.

Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.

ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.

BRUSHFIRE has monitored inbound VPN traffic to compromised appliances until specific inbound packets contain a specific magic string/pattern instead of external beaconing.

Mini Shai-Hulud has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.