Procedure examples

BlackByte Ransomware uses mapped shared folders to transfer ransomware payloads via SMB.

Ryuk has used the C$ network share for lateral movement.

LockBit 2.0 has the ability to move laterally via SMB.

Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.

Kwampirs copies itself over network shares to move laterally on a victim network.

Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.

Zox has the ability to use SMB for communication.

Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.

HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.

Lateral movement can be done with Net through net use commands to connect to the on remote systems.

Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.

PsExec, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.

SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.

Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.

During Cutting Edge, threat actors used SSH for lateral movement.

During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.

Leviathan used SSH brute force techniques to move laterally within victim environments during Leviathan Australian Intrusions.

Indrik Spider has used SSH for lateral movement.

GCMAN uses Putty for lateral movement.

Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.

Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.

TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

FIN7 has used SSH to move laterally through victim environments.

Rocke has spread its coinminer via SSH.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

APT39 used secure shell (SSH) to move laterally among their targets.

UNC3886 has established remote SSH access to targeted ESXi hosts.

OilRig has used Putty to access compromised systems.

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.

BlackTech has used Putty for remote access.

Leviathan used ssh for internal reconnaissance.

APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.

Fox Kitten has used the PuTTY and Plink tools for lateral movement.

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.

reGeorg can communicate using SSH through an HTTP tunnel.

Cobalt Strike can SSH to a remote service.

Kinsing has used SSH for lateral movement.

Qilin can enable SSH access on ESXi hosts.

Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.

GCMAN uses VNC for lateral movement.

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

FIN7 has used TightVNC to control compromised hosts.

Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.

TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network

Latrodectus has routed C2 traffic using Keyhole VNC.

DanBot can use VNC for remote access to targeted systems.