Procedure examples

Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.

DarkTortilla can detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.

IMAPLoader is executed via the AppDomainManager injection technique.

Pacu can create snapshots of EBS volumes and RDS instances.

During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.

Scattered Spider has created Amazon EC2 instances within the victim's environment.

LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.

Storm-0501 has conducted mass deletion of cloud data stores and resources from Azure subscriptions.

LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.

Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .

Storm-0501 has enumerated compromised cloud environments to identify critical assets, data stores, and back resources.

Pacu can enumerate AWS infrastructure, such as EC2 instances.

TruffleHog can enumerate AWS Infrastructure to include EC2 instances.

TeamPCP Cloud Stealer has the ability to search for generic GitHub runners.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.

Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.

Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.

Sandworm Team used various third-party email campaign management services to deliver phishing emails.

Contagious Interview has used services such as Astrill VPN.

Sea Turtle accessed victim networks from VPN service provider networks.

Star Blizzard has used HubSpot and MailerLite marketing platform services to hide the true sender of phishing emails.

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.

Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.

In May 2026 TeamPCP announced co-ownership of the BreachForums cybercriminal forum claiming responsibility for platform operations, dispute resolution, personnel vetting, and hosting monetary contests.

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.

During SharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.

Mustang Panda registered adversary-controlled domains during RedDelta Modified PlugX Infection Chain Operations that were re-registrations of expired domains.

During Operation Honeybee, threat actors registered domains for C2.

For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.

During Indian Critical Infrastructure Intrusions, RedEcho registered domains spoofing Indian critical infrastructure entities.

For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.

For C0021, the threat actors registered domains for use in C2.

For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.

For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.

For FunnyDream, the threat actors registered a variety of domains.

For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.

For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.

For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.

APT38 has created fake domains to imitate legitimate venture capital or bank domains.

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.

EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.

Dragonfly has registered domains for targeting intended victims.

menuPass has registered malicious domains for use in intrusion campaigns.

APT32 has set up and operated websites to gather information and deliver malware.

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.

RedEcho has registered domains spoofing Indian critical infrastructure entities.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.