Procedure examples

Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.

OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.

SombRAT has the ability to modify its process memory to hide process command-line arguments.

Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.

Kimsuky has leveraged the PowerShell `-ErrorAction SilentlyContinue` command to continue execution through system events.

UNC3886 modified the startup file `/etc/init.d/localnet` to execute the line `nohup /bin/support &` so the script would run when the system was rebooted.

Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.

BOLDMOVE calls the signal function to ignore the signals SIGCHLD, SIGHIP, and SIGPIPE prior to starting primary logic.

The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.

BPFDoor sets its process to ignore the following signals; `SIGHUP`, `SIGINT`, `SIGQUIT`, `SIGPIPE`, `SIGCHLD`, `SIGTTIN`, and `SIGTTOU`.

Shai-Hulud has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with `code 0`.

OSX/Shlayer has used the `nohup` command to instruct executed payloads to ignore hangup signals.

Mini Shai-Hulud has suppressed output so that nothing is printed to terminal and has utilized silent exiting when environmental variables match restricted values.

Turla has placed LunarWeb install files into directories that are excluded from scanning.

KV Botnet Activity leveraged a bind mount to bind itself to the `/proc/` file path before deleting its files from the `/tmp/` directory.

FIN13 has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.

PHASEJAM has blocked legitimate upgrades of Ivanti Connect Secure systems and falsely indicates a successful upgrade while operating on an older version.

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.

MultiLayer Wiper changes the original path information of deleted files to make recovery efforts more difficult.

SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.

LightNeuron is capable of modifying email content, headers, and attachments during transit.

GlassWorm can intercept and modify transaction details associated with hardware wallet applications before signing.

Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.

Kimsuky has used spearphishing to gain initial access and intelligence.

AppleJeus has used spearphishing emails to distribute malicious payloads.

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.

Sea Turtle used spear phishing to gain initial access to victims.

Axiom has used spear phishing to initially compromise victims.

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.

INC Ransom has used phishing to gain initial access.

VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector.

Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.

Hikit has been spread through spear phishing.

INC Ransomware campaigns have used spearphishing emails for initial access.

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.

During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.

Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.

During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.

During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.

Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers.

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.

During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.

APT38 has conducted spearphishing campaigns using malicious email attachments.

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.

SideCopy has sent spearphishing emails with malicious hta file attachments.