Procedure examples

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

RedCurl has used batch scripts to collect data.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Chimera has used custom DLLs for continuous retrieval of data from memory.

Ember Bear engages in mass collection from compromised systems during intrusions.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Volt Typhoon has obtained victim's screen dimension and display device information.

Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

TeamTNT has searched for attached VGA devices using lspci.

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.

OilRig has used tools to identify if a mouse is connected to a targeted system.

Turla has used fsutil fsinfo drives to list connected drives.

Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.

BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.

APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.

VOID MANTICORE has gathered audio during a Zoom session.

Kimsuky has gathered the system time of the device using the PowerShell cmdlet `Get-Date`.

Volt Typhoon has obtained the victim's system timezone.

FIN7 has used the PowerShell script 3CF9.ps1 to execute `net time`.

CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.

Sidewinder has used tools to obtain the current system time.

ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.

UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.

Higaisa used a function to gather the current time.

The White Company has checked the current date on the victim system.

Turla surveys a system upon check-in to discover the system time by using the net time command.

Chimera has used time /t and net time \\ip/hostname for system time discovery.

BRONZE BUTLER has used net time to check the local time on a target system.

Darkhotel malware can obtain system time from a compromised host.

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.

FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.

Ember Bear has exfiltrated images from compromised IP cameras.

Silence has been observed making videos of victims to observe bank employees day to day activities.

VOID MANTICORE has collected video from compromised victim devices.

Mustang Panda has leveraged `LoadLibrary` to load DLLs.

Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.

Patchwork used Base64 to encode C2 traffic.

HAFNIUM has used ASCII encoding for C2 traffic.

MuddyWater has used tools to encode C2 communications including Base64 encoding.

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.

TA551 has used encoded ASCII text for initial C2 communications.

APT42 has encoded C2 traffic with Base64.

A Lazarus Group malware sample encodes data with base64.

APT33 has used base64 to encode command and control traffic.