Procedure examples

Poseidon Group searches for administrator accounts on both the local victim machine and the network.

RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .

Lotus Blossom has used `net` commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.

Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

MirrorFace has used native Windows tools to obtain domain user information.

BRONZE BUTLER has used net user /domain to identify account information.

ToddyCat has run `net user %USER% /dom` for account discovery.

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.

INC Ransom has scanned for domain admin accounts in compromised environments.

LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.

Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.

VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.

FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.

TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.

RedCurl has collected information about email accounts.

Magic Hound has used Powershell to discover email accounts.

Storm-0501 has conducted enumeration of users, roles, and resources within victim Azure tenants using the tool Azurehound.

APT29 has conducted enumeration of Azure AD accounts.

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

APT41 used a tool called CLASSFON to covertly proxy network communications.

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.

Contagious Interview has leveraged Astrill VPN for C2.

Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.

POLONIUM has used the AirVPN service for operational activity.

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.

Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.

Turla RPC backdoors have included local UPnP RPC proxies.

Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.

Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.

Earth Lusca adopted Cloudflare as a proxy for compromised servers.

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.

CopyKittens has used the AirVPN service for operational activity.

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.

Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

Higaisa discovered system proxy settings and used them if available.

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.

Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.

FIN13 has utilized a proxy tool to communicate between compromised assets.

GALLIUM used a modified version of HTRAN to redirect connections between networks.

An APT3 downloader establishes SOCKS5 connections for its initial C2.

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.