Procedure examples

LockBit 2.0 can check if a targeted machine is using a set of Eastern European languages and exit without infection if so.

REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.

GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.

Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.

StealBit can determine system location based on the default language setting and will not execute on systems located in former Soviet countries.

Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.

XCSSET uses AppleScript to check the host's language and location with the command user locale of (get system info).

Mini Shai-Hulud has the ability to check system details for its language configuration and terminates actions when the system is configured for the Russian language.

CanisterWorm has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.

Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions.

Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.

Emissary has the capability to execute gpresult.

DUSTTRAP can identify victim environment Group Policy information.

LunarWeb can capture information on group policy settings

BloodHound has the ability to collect local admin information via GPO.

Empire includes various modules for enumerating Group Policy.

Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.

TruffleHog can enumerate cloud storage environments including Amazon Web Service (AWS) S3 buckets and Google Cloud Storage buckets.

Peirates can list AWS S3 buckets.

ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.

During SharePoint ToolShell Exploitation, threat actors reflectively loaded payloads using `System.Reflection.Assembly.Load`.

During the 3CX Supply Chain Attack, AppleJeus leverages the publicly available open-source project DAVESHELL to convert PE-COFF files to position-independent code to reflectively load the payload into memory.

Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory. Kimsuky has also used reflective loading through .NET assembly using `[System.Reflection.Assembly]::Load`.

Gamaredon Group has used an obfuscated PowerShell script that used `System.Reflection.Assembly` to gather and send victim information to the C2.

FIN7 has loaded a .NET assembly into the currect execution context via `Reflection.Assembly::Load`.

Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.

Pikabot reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.

Emotet has reflectively loaded payloads into memory.

BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.

SystemBC has downloaded a text file into memory and set the area of memory via the VirtualProtect call. Then, SystemBC has executed the file via the CreateThread call.

WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.

LunarLoader can use reflective loading to decrypt and run malicious executables in a new thread.

PlugX has loaded its payload into memory.

Lumma Stealer has used reflective loading techniques to load content into memory during execution.

Cuba loaded the payload into memory using PowerShell.

ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.

MuddyViper has reflectively loaded the decrypted HackBrowserData tool in a new thread.

Fooder has reflectively loaded a payload into memory.

Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.

Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.

Lokibot has reflectively loaded the decoded DLL into memory.

IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.

BRUSHFIRE has executed its commands within memory and is not saved on disk.

Gelsemium can use custom shellcode to map embedded DLLs into memory.

Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.

SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.

PowerSploit reflectively loads a Windows PE file into a process.