Procedure examples

During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.

For Operation Dust Storm, the threat actors disguised some executables as JPG files.

During C0018, AvosLocker was disguised using the victim company name as the filename.

During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.

During Salesforce Data Exfiltration, threat actors used voice calls to socially engineer victims into authorizing a modified version of the Salesforce Data Loader app.

ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.

KV Botnet Activity installation steps include first identifying, then stopping, any process containing [kworker\/0:1], then renaming its initial installation stage to this process name.

During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.

Mustang Panda masqueraded Registry run keys as legitimate-looking service names such as `OneNote Update` during RedDelta Modified PlugX Infection Chain Operations.

During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.

During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.

During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.

During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.

In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.

During the J-magic Campaign, threat actors used the name “JunoscriptService” to masquerade malware as the Junos automation scripting service.

During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.

During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.

During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.

During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.

During the 2025 Poland Wiper Attacks, the adversaries created rules that mimicked the name of an institution already present in the network device configuration to avoid detection.

During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.

During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.

During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.

During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.

During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.

During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System).

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.

During C0015, the threat actors collected files from network shared drives prior to network encryption.

During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems.

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.

During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.

During SharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.

During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.

During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server.

During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.

During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.

ArcaneDoor included use of existing command and control channels for data exfiltration.

During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.

Leviathan exfiltrated collected data over existing command and control channels during Leviathan Australian Intrusions.

During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to enumerate internal network services and endpoints across targeted environments using browser automation via MCP, including databases, container registries, admin interfaces, and workflow orchestration platforms.

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.