Procedure examples

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.

Kimsuky created and used a mailing toolkit to use in spearphishing attacks.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Moonstone Sleet developed malicious npm packages for delivery to or retrieval by victims.

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.

For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.

In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.

For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.

For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.

During Salesforce Data Exfiltration, threat actors created malicious applications within Salesforce trial accounts, typically Python scripts with similar function to the Salesforce Data Loader.

For Outer Space, OilRig created new implants including the Solar backdoor.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

During the 2025 Poland Wiper Attacks, the adversaries observed that their malware was initially detected by the victims EDR solutions, so they modified the payload and attempted to execute the new version within the same day.

For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.

Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.

During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.

For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.

Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Salt Typhoon has used custom tooling including JumbledPath.

TeamTNT has developed custom malware such as Hildegard.

FIN7 has developed malware for use in operations, including the creation of infected removable media.

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Mustang Panda has developed custom malware for use in their operations.

UNC3886 has deployed custom malware families on Fortinet and VMware systems.

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.

Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.

OilRig actively developed and used a series of downloaders during 2022.

Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Turla has developed its own unique malware for use in operations.

RedCurl has created its own tools to use during operations.

APT29 has used unique malware in many of their operations.

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.

Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

LuminousMoth has used unique malware for information theft and exfiltration.

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.

Lazarus Group has developed custom malware for use in their operations.

Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.

VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.

Play developed and employ Playcrypt ransomware.

FIN13 has utilized custom malware to maintain persistence in a compromised environment.

TeamPCP has developed and deployed custom malware including TeamPCP Cloud Stealer, CanisterWorm, and Mini Shai-Hulud.

During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.

Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.

PROMETHIUM has created self-signed certificates to sign malicious installers.