Procedure examples

Daggerfly created code signing certificates to sign malicious macOS files.

During the J-magic Campaign, threat actors used self-signed certificates on VPS C2 infrastructure.

ArcaneDoor included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.

For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.

Gamaredon Group has used the same TLS certificate across its infrastructure.

Storm-0501 has utilized their own self-signed TLS certificate “Microsoft IT TLS CA 5” with their infrastructure.

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to research exploitation techniques for an identified SSRF vulnerability, to generate a tailored custom attack payload, and to develop a full exploit chain prior to deployment.

Volt Typhoon has exploited zero-day vulnerabilities for initial access.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.

ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.

For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.

During the J-magic Campaign campaign, threat actors used open-source malware post-compromise including a custom variant of the cd00r backdoor.

For C0015, the threat actors used Cobalt Strike and Conti ransomware.

For FunnyDream, the threat actors used a new backdoor named FunnyDream.

During Night Dragon, threat actors used Trojans from underground hacker websites.

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.

Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.

Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.

TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.

Aquatic Panda has acquired and used njRAT in its operations.

APT1 used publicly available malware for privilege escalation.

Turla has used malware obtained after compromising other threat actors, such as OilRig.

TA505 has used malware such as Azorult and Cobalt Strike in their operations.

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

Ember Bear has acquired malware and related tools from dark web forums.

LazyScripter has used a variety of open-source remote access Trojans for its operations.

LuminousMoth has obtained and used malware such as Cobalt Strike.

Metador has used unique malware in their operations, including metaMain and Mafalda.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.

LAPSUS$ acquired and used the Redline password stealer in their operations.

VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.

During SharePoint ToolShell Exploitation, threat actors leveraged tools including Impacket, PsExec, and Mimikatz.

For Frankenstein, the threat actors obtained and used Empire.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.

In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.

For Operation Spalax, the threat actors obtained packers such as CyaX.

During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.

For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.

During ShadowRay, threat actors used tools including the XMRig miner and Interactsh.

During the Anthropic AI-orchestrated Campaign, the adversary obtained open-source penetration testing tools including network scanners, database exploitation frameworks, password crackers, and binary analysis suites.

For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.

During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.