Procedure examples

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.

Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.

Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.

Magic Hound has attempted to lure victims into opening malicious email attachments.

Ajax Security Team has lured victims into executing malicious files.

Threat Group-3390 has lured victims into opening malicious files containing malware.

APT33 has used malicious e-mail attachments to lure victims into executing malware.

FIN8 has used malicious e-mail attachments to lure victims into executing malware.

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.

TeamTNT has relied on users to download and execute malicious Docker images.

Kimsuky has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.

Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.

Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.

Kimsuky has used TRANSLATEXT to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

Mustang Panda has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.

UNC3886 has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.

UNC3886 maintained persistence on FortiGate Firewalls through ICMP port knocking.

PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.

Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.

Fox Kitten has exploited known vulnerabilities in remote services including RDP.

Tonto Team has used EternalBlue exploits for lateral movement.

Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).

Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.

ShinyHunters has exploited vulnerabilities in remote services for lateral movement.

APT28 has used CVE-2015-4902 to bypass security features.

Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.

UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.

APT28 has collected files from various information repositories.

LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.

HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.