Procedure examples

Medusa Group has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.

Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.

Sea Turtle captured legitimate SSL certificates from victim organizations and installed these on Sea Turtle-controlled infrastructure to enable subsequent adversary-in-the-middle operations.

For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.

Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.

Dragonfly has compromised websites to redirect traffic and to host exploit kits.

APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.

FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.

CURIUM used strategic website compromise to fingerprint then target victims.

LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.

During Operation AkaiRyū, MirrorFace used links to direct victims to malicious files hosted on OneDrive.

During Salesforce Data Exfiltration, threat actors established an Okta phishing panel which victims were tricked into accessing from mobile phones or work computers during social engineering calls.

FIN7 has created a fake link that redirected to an adversary-controlled Dropbox that downloaded the malicious executable.

Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.

LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.

Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware.

TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.

Hildegard was executed through the kubelet API run command and by executing commands on running containers.

Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.

Kinsing was executed with an Ubuntu container entry point that runs shell scripts.

Peirates can use `kubectl` or the Kubernetes API to run commands.

TeamPCP Cloud Stealer can use `kubectl get secrets` to extract credentials from Kubernetes.

Mini Shai-Hulud has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities `kubectl get secrets`.

CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.

Kinsing was run through a deployed Ubuntu container.

TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.

Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.

Doki was run through a deployed container.

TeamTNT has deployed privileged containers that mount the filesystem of victim machine.

Hildegard has used the BOtB tool that can break out of containers.

Doki’s container was configured to bind the host root directory.

Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.

Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect. TeamTNT has also searched for Kubernetes pods running in a local network.

Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.

Peirates can enumerate Kubernetes pods in a given namespace.

TeamPCP Cloud Stealer can identify Docker and Kubernetes environments for credentials.

CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters. CanisterWorm has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.

SideCopy has identified the country location of a compromised host.

Volt Typhoon has obtained the victim's system current location.

Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.

Tsundere Botnet has checked the victim machine’s location by obtaining the culture name of the machine.

InvisibleFerret has collected the internal IP address, IP geolocation information of the infected host and sends the data to a C2 server. InvisibleFerret has also leveraged the “pay” module to obtain region name, country, city, zip code, ISP, latitude and longitude using “http://ip-api.com/json”.

Crimson can identify the geographical location of a victim host.

Gootloader can use IP geolocation to determine if the person browsing to a compromised site is within a targeted territory such as the US, Canada, Germany, and South Korea.

HexEval Loader has a function where the C2 endpoint can identify the geographical location of a victim host based on request headers, execution environment and runtime conditions.

Cuckoo Stealer can determine the geographical location of a victim host by checking the language.

SameCoin can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.