Procedure examples

Cobalt Group has used DNS tunneling for C2.

APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.

Mustang Panda has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.

Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.

Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.

VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.

ShinyHunters has abused software deployment tools for lateral movement.

Volt Typhoon has staged collected data in password-protected archives.

Scattered Spider stages data in a centralized database prior to exfiltration.

INC Ransom has staged data on compromised hosts prior to exfiltration.

Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.

VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.

Indrik Spider has stored collected data in a .tmp file.

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.

APT3 has been known to stage files for exfiltration in a single location.

Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\. Kimsuky has also gathered data in structured directories prior to exfiltration under the %TEMP% environment variable.

Volt Typhoon has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.

Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.

Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.

TeamTNT has aggregated collected credentials in text files before exfiltrating.

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

APT39 has utilized tools to aggregate data prior to exfiltration.

UNC3886 has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.

Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.

Chimera has staged stolen data locally on compromised hosts.

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

APT28 has stored captured credential information in a file named pi.log.

APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.

Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.

WIRTE has staged collected documents of interest in `C:\Users\Public folder`.

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.

FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.

Sea Turtle staged collected email archives in the public web directory of a website that was accessible from the internet.

Leviathan has staged data remotely prior to exfiltration.

MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.

Chimera has staged stolen data on designated servers in the target environment.

MirrorFace has gathered data and files of interest on a single victim machine.

ToddyCat manually transferred collected files to an exfiltration host using xcopy.