Procedure examples

APT39 has used malware to decrypt encrypted CAB files.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.

TA505 has decrypted packed DLLs with an XOR key.

Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

Darkhotel has decrypted strings and imports using RC4 during execution.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Malteiro has the ability to deobfuscate downloaded files prior to execution.

Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Earth Lusca has used certutil to decode a string into a cabinet file.

Molerats decompresses ZIP files once on the victim machine.

Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.

WIRTE has used Base64 to decode malicious VBS script.

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.

FIN13 has utilized `certutil` to decode base64 encoded versions of custom malware.

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.

Mustang Panda has leveraged Visual Studio Code’s (VSCode) embedded reverse shell feature using the command `code.exe tunnel` to execute code and deliver additional payloads.

TeamPCP has compromised VS Code and Open VSX IDE extensions.

Kimsuky has the ability to use form-grabbing to extract emails and passwords from web data forms.

Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.

DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.

APT38 has conducted watering holes schemes to gain initial access to victims.

Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

Patchwork has used watering holes to deliver files with exploits to initial victims.

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

APT32 has infected victims by tricking them into visiting compromised watering hole websites.

Leafminer has infected victims using watering holes.

Machete has distributed Machete through a fake blog website.

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

Windigo has distributed Windows malware via drive-by downloads.

Leviathan has infected victims using watering holes.

Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.

Turla has infected victims using watering holes.

Dark Caracal leveraged a watering hole to serve up malicious code.

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.

Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.

Axiom has used watering hole attacks to gain access.

Windshift has used compromised websites to register custom URL schemes on a remote system.

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.