Procedure examples

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.

Kimsuky has obfuscated HTTP Post request communications utilizing XOR with a designated key, followed by Base64 encoding.

GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.

Kimsuky has used RDP to establish persistence.

Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.

Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.

APT18 actors leverage legitimate credentials to log into external remote services.

Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.

Akira uses compromised VPN accounts for initial access to victim networks.

OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.

Sea Turtle has used external-facing SSH to achieve initial access to the IT environments of victim organizations.

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.

Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.

FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.

APT29 has used compromised identities to access networks via VPNs and Citrix.

Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.

Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.

APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.

APT-C-36 has used VPNs in their operational infrastructure.

GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.

LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.

Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.

Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.

VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.

Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).

FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.

Blue Mockingbird has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.

Lotus Blossom has retrieved process tokens for processes to adjust the privileges of the launch process or other items.

APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

Turla RPC backdoors can impersonate or steal process tokens before executing commands.

Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.

BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.

FIN13 has utilized tools such as Incognito V2 for token manipulation and impersonation.

APT38 has enumerated network shares on a compromised host.

BlackByte enumerated network shares on victim devices.

APT41 used the net share command as part of network reconnaissance.

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

Tropic Trooper used netview to scan target systems for shared resources.

APT1 listed connected network shares.

DarkVishnya scanned the network for public shared folders.

Chimera has used net share and net view to identify network shares of interest.

Medusa Group has identified network shares using `cmd.exe /c net share`.