Procedure examples

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.

Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.

During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to catalog services and data on discovered endpoints.

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.

Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.

Magic Hound has captured the user-agent strings from visitors to their phishing sites.

During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to gather details of high-value systems to include databases and workflow orchestration platforms.

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.

Volt Typhoon has conducted pre-compromise web searches for victim information.

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.

Mustang Panda has used open-source research to identify information about victims to use in targeting to include creating weaponized phishing lures and attachments.

Contagious Interview has utilized open-source indicator of compromise repositories to determine their exposure to include VirusTotal, and MalTrail.

Star Blizzard has used open-source research to identify information about victims to use in targeting.

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.

For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.

EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.

APT41 DUST involved use of search engines to research victim servers.

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.

HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.

Contagious Interview had identified and solicited victims through code repositories such as GitHub.

LAPSUS$ has searched public code repositories for exposed credentials.

Shai-Hulud has the ability to search open sites and code repositories for compromised credentials. Shai-Hulud has discovered packages associated with compromised accounts. Shai-Hulud has also searched code repositories for other compromised repositories that include predefined parameters or markers to include “Second Coming” combined with an 18-character alphanumeric string.

ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.

During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.

APT41 DUST involved access of external victim websites for target development.

Leviathan enumerated compromised web application resources to identify additional endpoints and resources linkd to the website for follow-on access during Leviathan Australian Intrusions.

Kimsuky has searched for information on the target company's website.

EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.

Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.

Sandworm Team has conducted research against potential victim websites as part of its operational planning.

Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.

TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.

In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan infrastructure across IP ranges associated with the target organization.

TeamTNT has scanned specific lists of target IP addresses.

Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.

During SharePoint ToolShell Exploitation, threat actors scanned for SharePoint servers vulnerable to CVE-2025-53770.

During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to scan target infrastructure to identify potential vulnerabilities and to enumerate services and endpoints.

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.

Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.

Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.