Procedure examples

Volatile Cedar has performed vulnerability scans of the target server.

APT28 has performed large-scale scans in an attempt to find vulnerable servers.

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.

ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.

APT41 leverages various tools and frameworks to brute-force directories on web servers.

Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.

Kimsuky has used LLMs to better understand publicly reported vulnerabilities.

APT28 has used large language models (LLMs) to assist in script development and deployment.

APT41 DUST used internet scan data for target development.

Volt Typhoon has used FOFA, Shodan, and Censys to search for exposed victim infrastructure.

APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.

EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.

LAPSUS$ has purchased credentials and session tokens from criminal underground forums.

Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.

Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.

APT28 has used spearphishing to compromise credentials.

Moonstone Sleet has interacted with victims to gather information via email.

ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.

During C0027, Scattered Spider sent Telegram messages impersonating IT personnel to harvest credentials.

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.

Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.

Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with attachments containing links to credential-stealing sites.

Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.

Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.

Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.

APT32 has used malicious links to direct users to web pages designed to harvest credentials.

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.

CURIUM used malicious links to adversary-controlled resources for credential harvesting.

Sidewinder has sent e-mails with malicious links to credential harvesting websites.

Mustang Panda has delivered web bugs to profile their intended targets.

ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.

Scattered Spider has used domains mirroring corporate login portals to socially engineer victims into providing credentials.

Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.

Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.

Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.

SMOKEDHAM has been delivered via malicious links in phishing emails.

evilginx2 can generate and display phishing URLs including hidden tracking pixels and can also embed URLs within iframes for browser-in-the-browser phishing.

AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.

ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.

During Salesforce Data Exfiltration, threat actors initiated voice calls with victims to socially engineer them into authorizing malicious applications or divulging sensitive credentials.

During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.

Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.

LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.

Indian Critical Infrastructure Intrusions involved the use of FRP to bridge network boundaries and overcome NAT. Indian Critical Infrastructure Intrusions also involved the use of VPN tunnels with a potentially compromised MSP entity allowing for direct access to critical infrastructure entity networks.