Procedure examples

Royal can use `GetLogicalDrives` to enumerate logical drives.

Bandook can collect information about the drives available on the system.

KONNI can gather information on connected drives and disk space from the victim’s machine.

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.

KGH_SPY can collect drive information from a compromised host.

down_new has the ability to identify the system volume information of a compromised host.

Black Basta can enumerate volumes.

Attor monitors the free disk space on the system.

LitePower has the ability to list local drives.

Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

HermeticWiper can enumerate physical drives on a targeted host.

LockBit 2.0 can enumerate local drive configuration.

Zebrocy collects the serial number for the storage volume C:\.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s volume ID.

REvil can identify system drive information on a compromised host.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.

AshTag can use `volumeserialnumber` to enumerate volumes.

MacMa can collect information about a compromised computer's disk sizes.

FunnyDream can enumerate all logical drives on a targeted machine.

ROADSWEEP can enumerate logical drives on targeted devices.

SysUpdate can collect a system's drive information.

InnaputRAT gathers volume drive information.

FELIXROOT collects the victim’s volume serial number.

Penquin can report the disk space of a compromised host to C2.

Cannon can gather drive information from the victim's machine.

build_downer has the ability to send system volume information to C2.

Heyoka Backdoor can enumerate drives on a compromised host.

Octopus can collect system drive and disk size information.

KillDisk retrieves the hard disk name by calling the CreateFileA to \\.\PHYSICALDRIVE0 API.

Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

SoreFang can collect disk space information on victim machines by executing Systeminfo.

Pasam creates a backdoor through which remote attackers can retrieve information like free disk space.

ShadowPad has discovered system information including volume serial numbers.

INC Ransomware can discover and mount hidden drives to encrypt them.

Zox can enumerate attached drives.

SLOTHFULMEDIA has collected disk information from a victim machine.

FALLCHILL can collect information about installed disks from the victim.

SILENTTRINITY can collect information related to a compromised host, including a list of drives.

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`

CrackMapExec can enumerate the system drives and associated system name.

ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.

UNC3886 has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.

Contagious Interview has registered accounts with Threat Intelligence vendor services to check for reporting associated with their infrastructure and to evaluate new potential infrastructure.

Kimsuky has used LLMs to identify think tanks, government organizations, and experts to inform targeting for spearphishing campaigns.

APT42 has leveraged LLMs to search for official emails to build target lists, and conduct reconnaissance on potential business partners.

During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to automatically generate comprehensive documentation throughout the phases of the attack, including discovered services, harvested credentials, sensitive data, exploitation techniques, and complete attack progression.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.

TeamPCP has created Dune-themed GitHub repositories using stolen tokens.

Kali365 has generated tailored branded phishing lures to target victims utilizing a myriad of reputable services and brands that entice users to interact with the content. Kali365 has also been enabled with AI such as Claude Sonnet that evaluates emails and generates tailored responses to facilitate BEC activities.