Procedure examples

Chimera has collected documents from the victim's SharePoint.

APT28 has collected information from Microsoft SharePoint services within target networks.

LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.

VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.

spwebmember is used to enumerate and dump information from Microsoft SharePoint.

TruffleHog has searched SharePoint for data and credentials.

During the SolarWinds Compromise, APT29 downloaded source code from code repositories.

APT41 cloned victim user Git repositories during intrusions.

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.

LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.

GlassWorm has gathered code repository authentication materials for NPM and GitHub. GlassWorm has collected details pertaining to the npm configuration data for `_authToken`.

Shai-Hulud has downloaded existing packages from code repositories and extracted data stored within them.

TruffleHog has gathered data and credentials from code repositories.

TeamPCP Cloud Stealer can target sensitive file paths in Git repos to extract credentials.

Mini Shai-Hulud has gathered and downloaded data stored on both compromised and publicly accessible code repositories.

ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.

During Salesforce Data Exfiltration, threat actors accessed and exfiltrated sensitive information from compromised Salesforce instances.

Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.

Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.

LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.

TruffleHog has obtained data and credentials associated with messaging applications to include Slack.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal databases and systems to extract proprietary information, system configurations, and sensitive operational data.

APT41 DUST collected data from victim Oracle databases using SQLULDR2.

Leviathan gathered information from SQL servers and Building Management System (BMS) servers during Leviathan Australian Intrusions.

FIN6 has collected schemas and user accounts from systems running SQL Server.

Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.

Sea Turtle used the tool Adminer to remotely logon to the MySQL service of victim machines.

Turla has used a custom .NET tool to collect documents from an organization's internal central database.

P.A.S. Webshell has the ability to list and extract data from SQL databases.

GlassWorm has collected data from macOS devices through the gathering of Apple Notes related files by targeting `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`, `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal`, and `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm`.

MgBot includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.

TeamPCP Cloud Stealer can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.

ShinyHunters has collected Salesforce datasets from victims in the airline and retail sectors.

APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.

During the 3CX Supply Chain Attack, AppleJeus leveraged ICONICSTEALER to steal browser information to include browser history located on the infected host.

During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) data stealers to collect cookies, browsing history, and credentials.

During Operation AkaiRyū, MirrorFace exported Chrome web data including contact information, keywords, autofill data, and stored credit card information.

During Outer Space, OilRig used a Chrome data dumper named MKG.

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

Kimsuky has collected sensitive browser data using the function `GetBrowserData()` to include login credentials, bookmarks, cookies, and encryption keys.

Volt Typhoon has targeted the browsing history of network administrators.

Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.

Chimera has used type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix* for bookmark discovery.

Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.

Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.

Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.

PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.

Cuckoo Stealer can collect bookmarks, cookies, and history from Safari.

MobileOrder has a command to upload to its C2 server victim browser bookmarks.