Procedure examples

BITTER has obtained tools such as PuTTY for use in their operations.

DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.

Lotus Blossom has used publicly-available tools such as a Python-based cookie stealer for Chrome browsers, Impacket, and the Venom proxy tool.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.

Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.

Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning. Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery. Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.

Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.

Whitefly has obtained and used tools such as Mimikatz.

LuminousMoth has obtained an ARP spoofing tool from GitHub.

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

Metador has used Microsoft's Console Debugger in some of their operations.

APT42 has used built-in features in the Microsoft 365 environment and publicly available tools to avoid detection.

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.

INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.

Earth Lusca has acquired and used a variety of open source tools.

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.

Thrip has obtained and used tools such as Mimikatz and PsExec.

LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.

Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.

CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.

Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.

Inception has obtained and used open-source tools such as LaZagne.

VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.

Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.

WIRTE has obtained and used Empire and Rclone for post-exploitation activities.

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.

FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.

FIN8 has used open-source tools such as Impacket for targeting efforts.

FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.

APT19 has obtained and used publicly-available tools like Empire.

PittyTiger has obtained and used tools such as Mimikatz and gsecdump.

FIN7 has obtained and used tools such as Impacket, Mimikatz, and PsExec.

ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.

During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.

During HomeLand Justice, threat actors used tools with legitimate code signing certificates.

APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.

Kimsuky has stolen a valid certificate that is used to sign the malware and the dropper.

Mustang Panda has used revoked code signing certificates for its malicious payloads.