Procedure examples

Contagious Interview has used AI to clone video-conferencing applications to distribute their BeaverTail malware. They have also used AI to create deepfake videos.

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.

ShinyHunters has used social engineering to demand payment from victims.

During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.

During Salesforce Data Exfiltration, threat actors impersonated IT support personnel in voice calls with victims at times claiming to be addressing enterprise-wide connectivity issues.

During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.

Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee. Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.

APT41 impersonated an employee at a video game developer company to send phishing emails.

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.

Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.

Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.

LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials.

APT42 has impersonated legitimate people in phishing emails to gain credentials.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.

LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.

WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.

RustyWater has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain `info@tmcell`.

NPPSPY creates a network listener using the misspelled label logincontroll recorded to the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\NetworkProvider\\Order.

TeamPCP impersonated legitimate maintainers to push imposter commits to the Aquasecurity Trivy scanner GitHub repository.

KV Botnet Activity used various scripts to remove or disable security tools, such as http_watchdog and firewallsd, as well as tools related to other botnet infections, such as mips_ff, on victim devices.

During SharePoint ToolShell Exploitation, threat actors disabled Microsoft Defender through Registry settings and real-time monitoring via PowerShell.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry internet settings to lower internet security.

During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.

During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response (EDR) solutions including Microsoft Defender Antivirus.

During the SolarWinds Compromise, APT29 used the service control manager on a remote system to disable services associated with security monitoring products.

ArcaneDoor modified the Authentication, Authorization, and Accounting (AAA) function of targeted Cisco ASA appliances to allow the threat actor to bypass normal AAA operations.

During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.

Quad7 Activity has disabled the TP-Link management interface for TP-Link by killing the /usr/bin/httpd process.

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.

APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.

MuddyWater can disable the system's local proxy settings.

FIN6 has deployed a utility script named kill.bat to disable anti-virus.

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.

Rocke used scripts which detected and uninstalled antivirus software.

Scattered Spider has uninstalled and disabled security tools.

UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.

Contagious Interview has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.

TA2541 has attempted to disable built-in security protections such as Windows AMSI.

Akira has disabled or modified security tools for defense evasion.

Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).