Procedure examples

APT41 used `NATBypass` to bypass firewall restrictions and to access compromised systems via RDP.

DRYHOOK has modified the Ivanti Connect Secure VPN authentication Perl module `DSAuth.pm` by reading its contents in the buffer, then finding and replacing select lines of code.

SYNful Knock is malware that is inserted into a network device by patching the operating system image.

During the 2025 Poland Wiper Attacks, the adversaries gathered and used the FortiGate bookmarks defined in the configuration file to include the statically defined credentials that facilitated RDP connections to jump hosts.

Salt Typhoon has attempted to acquire credentials by dumping network device configurations.

GlassWorm has gathered data pertaining to VPN configurations. GlassWorm has also targeted locally stored data on macOS located in `/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist`.

During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.

During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.

AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.

Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.

For Operation Dream Job, Lazarus Group used compromised servers to host malware.

Mustang Panda staged malware on adversary-controlled domains and cloud storage instances during RedDelta Modified PlugX Infection Chain Operations.

For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.

For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.

For C0021, the threat actors uploaded malware to websites under their control.

For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.

During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.

BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.

SideCopy has used compromised domains to host its malicious payloads.

Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants. Kimsuky has also hosted malicious payloads on Dropbox.

EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.

Gamaredon Group has registered domains to stage payloads.

TeamTNT has uploaded backdoored Docker images to Docker Hub.

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3. FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.

Mustang Panda has hosted malicious payloads on DropBox including PlugX.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.

OilRig has hosted malware on fake websites designed to target specific audiences.

Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.

TA505 has staged malware on actor-controlled domains.

BITTER has registered domains to stage payloads.

Star Blizzard has uploaded malicious payloads to cloud storage sites.

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.

LuminousMoth has hosted malicious payloads on Dropbox.

APT42 has used its infrastructure for C2 and for staging the VINETHORN payload, which masqueraded as a VPN application.

APT-C-36 has staged malware implants on group-owned repositories and sites.

Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.

Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.

WIRTE has directed victims to malicious payloads staged on file sharing services.

Threat Group-3390 has hosted malicious payloads on Dropbox.

Shai-Hulud has published malicious gzip-compressed tarball (.tgz) following modification of packages within compromised accounts. Shai-Hulud has also modified packages within compromised accounts.

TeamPCP has pushed GitHub commits that modified the actions/checkout to reference an imposter commit that downloaded malicious files from attacker-controlled C2 domains.

For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.

During the 2025 Poland Wiper Attacks, the adversaries had staged tools and files for use on Dropbox and Pastebin.

For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.