Procedure examples

OilRig has obtained stolen code signing certificates to digitally sign malware.

BlackTech has used stolen code-signing certificates for its malicious payloads.

Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.

FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.

MegaCortex has used code signing certificates issued to fake companies to bypass security controls.

Mustang Panda acquired Cloudflare Origin CA TLS certificates during RedDelta Modified PlugX Infection Chain Operations.

For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.

Indian Critical Infrastructure Intrusions included the use of digital certificates spoofing Microsoft.

Mustang Panda has obtained SSL certificates for their C2 domains.

UNC3886 has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.

Sea Turtle created new certificates using a technique called the actors performed "certificate impersonation," a technique in which Sea Turtle obtained a certificate authority-signed X.509 certificate from another provider for the same domain imitating the one already used by the targeted organization.

BlackTech has used valid, stolen digital certificates for some of their malware and tools.

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.

LuminousMoth has used a valid digital certificate for some of their malware.

Lazarus Group has obtained SSL certificates for their C2 domains.

Kimsuky has obtained exploit code for various CVEs.

Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.

Leviathan weaponized publicly-known vulnerabilities for initial access and other purposes during Leviathan Australian Intrusions.

Volt Typhoon has used publicly available exploit code for initial access.

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.

Storm-0501 has obtained capabilities to exploit N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).

During the Anthropic AI-orchestrated Campaign, the adversary obtained access to Claude Code to support cyber intrusion operations.

During the 2025 Poland Wiper Attacks, the adversaries generated custom script with an LLM.

Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.

APT28 has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.

LazyWiper is believed to have been generated by a large language model (LLM) due to the non-sensical comments in the code.

ShinyHunters has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.

For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.

During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.

Volt Typhoon has gathered victim identify information during pre-compromise reconnaissance.

APT32 has conducted targeted surveillance against activists and bloggers.

Scattered Spider has used information from previous data breaches to identify employee names to be used in social engineering.

Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.

Star Blizzard has identified ways to engage targets by researching potential victims' interests and social or professional contacts.

LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.

HEXANE has identified specific potential victims at targeted organizations.

Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.

FIN13 has researched employees to target for social engineering attacks.

For the SolarWinds Compromise, APT29 conducted credential theft operations to obtain credentials to be used for access to victim environments.

During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.

Leviathan has collected compromised credentials to use for targeting efforts.

Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.

APT28 has harvested user's login credentials.

LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.

Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.

ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.

Water Curupira Pikabot Distribution utilizes thread spoofing of existing email threads in order to execute spear phishing operations.

Quad7 Activity has gathered targeted individual’s e-mail addresses for the password spraying attempts.