Procedure examples

During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.

SPACEHOP Activity leverages a C2 framework sourced from a publicly-available Github repository for administration of relay nodes.

During Operation AkaiRyū, MirrorFace deployed multiple publicly available tools including PuTTY, FRP, and Rubeus.

For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.

For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.

During Salesforce Data Exfiltration, threat actors initially relied on the legitimate Salesforce Data Loader app for data exfiltration.

For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.

During Night Dragon, threat actors obtained and used tools such as gsecdump.

For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.

For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.

During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.

During CostaRicto, the threat actors obtained open source tools to use in their operations.

APT38 has obtained and used open-source tools such as Mimikatz.

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.

Patchwork has obtained and used open-source tools such as QuasarRAT.

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.

Salt Typhoon has used publicly available tooling to exploit vulnerabilities.

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.

Contagious Interview has used remote management and monitoring software such as “AnyDesk”.

TA2541 has used commodity remote access tools.

Moses Staff has used the commercial tool DiskCryptor.

OilRig has made use of the publicly available tools including Plink and Mimikatz.

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.

Sea Turtle has used tools such as Adminer during intrusions.

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.

Aquatic Panda has acquired and used Cobalt Strike in its operations.

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.

Ke3chang has obtained and used tools such as Mimikatz.

APT1 has used various open-source tools for privilege escalation purposes.

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.

BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.

Blue Mockingbird has obtained and used tools such as Mimikatz.

Turla has obtained and customized publicly-available tools like Mimikatz.

TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.