Procedure examples

During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.

During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL.

During C0015, the threat actors used Base64-encoded strings.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.

During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.

During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.

During SharePoint ToolShell Exploitation, threat actors UPX-packed malicous payloads including 4L4MD4R ransomware.

For Operation Dust Storm, the threat actors used UPX to pack some payloads.

For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.

During Night Dragon, threat actors used software packing in its tools.

During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.

For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.

During Operation Ghost, APT29 used steganography to hide payloads inside valid images.

In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.

During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.

During the 3CX Supply Chain Attack, AppleJeus uses embedded .dll as apart of a chained delivery mechanism to invoke the COM class factory.

For C0021, the threat actors embedded a base64-encoded payload within a LNK file.

During SharePoint ToolShell Exploitation, threat actors executed Base64-encoded PowerShell commands.

During Frankenstein, the threat actors ran encoded commands from the command line.

During C0018, the threat actors used Base64 to encode their PowerShell scripts.

During C0021, the threat actors used encoded PowerShell commands.

During Operation CuckooBees, the threat actors executed an encoded VBScript file.

During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.

During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.

Quad7 Activity has infected victim network devices by storing artifacts in the /tmp directory which is volatile in memory and will clear its contents upon shutdown or restart.

During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.

Mustang Panda stored installation payloads as encrypted files in hidden folders during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 generated Base64-encoded files in the FreeBSD shell environment of targeted Juniper devices.

During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.

During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.

For Operation Spalax, the threat actors used XOR-encrypted payloads.

During the 3CX Supply Chain Attack, AppleJeus encrypts its dynamic library files (.dll) using RC4, and when loaded only decrypts specific portions of the file using the key `3jB(2bsG#@c7`.

During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.

During ShadowRay, threat actors used Base64-encrypted Python code to evade detection.

During Outer Space, OilRig deployed VBS droppers with obfuscated strings.

During the 2025 Poland Wiper Attacks, the adversaries utilized a Base64-encoded ZIP archive to prevent content analysis.

APT41 DUST used encrypted payloads decrypted and executed in memory.

During Night Dragon, threat actors used a DLL that included an XOR-encoded section.

During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.

During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.

During SharePoint ToolShell Exploitation, threat actors executed `whoami` on victim machines to enumerate user context and validate privilege levels.

During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.

During C0018, the threat actors collected `whoami` information via PowerShell scripts.

During Operation Digital Eye, threat actors used `GetUserInfo` to identify current user information.

During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.

During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.

During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.

During C0017, APT41 used `whoami` to gather information from victim machines.

KV Botnet Activity involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.