Procedure examples

SameCoin can alter the victim’s background to display an image showing the name of Hamas’s military wing.

After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".

BlackCat can change the desktop wallpaper on compromised hosts.

Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.

ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.

Meteor can change both the desktop wallpaper and the lock screen image to a custom image.

Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.

INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

Remcos has the ability to modify the desktop wallpaper.

ShinyHunters has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.

Ember Bear is linked to the defacement of several Ukrainian organization websites.

During the 2025 Poland Wiper Attacks, adversaries performed a factory-reset on compromised devices that hampered forensic investigations.

TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.

Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.

During ShadowRay, threat actors leveraged graphics processing units (GPU) on compromised nodes for cryptocurrency mining.

APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.

TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.

Rocke has distributed cryptomining malware.

Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.

Hildegard has used xmrig to mine cryptocurrency.

Skidmap is a kernel-mode rootkit used for cryptocurrency mining.

Bonadan can download an additional module which has a cryptocurrency mining extension.

Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.

DarkGate can deploy follow-on cryptocurrency mining payloads.

Kinsing has created and run a Bitcoin cryptocurrency miner.

CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.

LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.

Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.

During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.

Contagious Interview has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.

Saint Bear contains several anti-analysis and anti-virtualization checks.

Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.

Bumblebee has the ability to perform anti-virtualization checks.

Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.

Raspberry Robin contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.

IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.

Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Bisonal can check to determine if the compromised system is running on VMware.

Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.

Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.

StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.

RTM can detect if it is running within a sandbox or other virtualized analysis environment.

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.

Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.

XLoader can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.

Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.

Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.