Procedure examples

BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.

GALLIUM has used PsExec to move laterally between hosts in the target network.

Volt Typhoon has copied web shells between servers in targeted environments.

APT41 uses remote shares to move and remotely execute payloads during lateral movemement.

APT32 has deployed tools after moving laterally using administrative accounts.

Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.

Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.

UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.

Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.

Chimera has copied tools between compromised hosts using SMB.

Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.

Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.

INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.

Magic Hound has copied tools within a compromised network using RDP.

FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.

Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.

Havoc has the ability to copy files from one location to another.

Emotet has copied itself to remote systems using the `service.exe` filename.

Olympic Destroyer attempts to copy itself to remote machines on the network.

SameCoin can copy its wiper executable to remote machines within the same Active Directory.

BlackCat can replicate itself across connected servers via `psexec`.

Lucifer can use certutil for propagation on Windows hosts within intranets.

LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.

DustySky searches for network drives and removable media and duplicates itself onto them.

Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.

WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.

VIRTUALPIE has file transfer capabilities.

Shamoon attempts to copy itself to remote machines on the network.

BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.

IPsec Helper can download additional payloads from command and control nodes and execute them.

OutSteel can download the Saint Bot malware for follow-on execution.

VIRTUALPITA is capable of file transfer and arbitrary command execution.

Qilin has used PsExec to distribute a second encryptor, named encryptor_1.exe, across the targeted environment.

INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.

HermeticWizard can copy files to other machines on a compromised network.

Impacket has used its `wmiexec` command, leveraging Windows Management Instrumentation, to remotely stage and execute payloads in victim networks.

BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.

cmd can be used to copy files to/from a remotely connected internal system.

esentutl can be used to copy files to/from a remote share.

Expand can be used to download or upload a file over a network share.

ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.

PsExec can be used to download or upload a file over a network share.

KV Botnet Activity generates a random port number greater than 30,000 to serve as the listener for subsequent command and control activity.

During RedPenguin, UNC3886 used a backdoor that binds to port 45678 by default.

During Indian Critical Infrastructure Intrusions, RedEcho used non-standard ports such as TCP 8080 for HTTP communication.

During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.