Procedure examples

TeamTNT has established tmate sessions for C2 communications.

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.

DarkVishnya used DameWare Mini Remote Control for lateral movement.

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.

INC Ransom has used AnyDesk and PuTTY on compromised systems.

Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.

ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.

Mustang Panda has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the `code.exe tunnel` command.

Kimsuky has used a modified TeamViewer client as a command and control channel.

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Mustang Panda has installed TeamViewer on targeted systems.

In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.

Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.

Thrip used a cloud-based remote access software called LogMeIn for their attacks.

VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.

Higaisa used an XSL file to run VBScript code.

Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.

Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.

DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.

Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.

MirrorFace has used remote template injection to retrieve malicious payloads from the C2.

APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.

Inception has used decoy documents to load malicious remote payloads via HTTP.

Storm-1811 has used `cacls.exe` via batch script to modify file and directory permissions in victim environments.

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.

APT32's macOS backdoor changes the permission of the file it wants to execute to 755.

TeamTNT has modified the permissions on binaries with chattr.

Rocke has changed file permissions of files so they could not be modified.

BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics. BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.

Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.

Contagious Interview has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.

APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.

APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.

Equation has been observed utilizing environmental keying in payload delivery.

APT38 has created a mutex to avoid duplicate execution.

Kimsuky has utilized a mutex to detect whether its malware is actively running on the victim host. Kimsuky has leveraged PowerShell to store the Process ID (PID) of the currently running malicious PowerShell script into a file named pid.txt which is saved locally on the victim host in the %TEMP% Directory and is queried prior to execution of subsequent PowerShell script to prevent duplication.

BlackByte enumerated Active Directory information and trust relationships during operations.

Storm-1811 has enumerated domain accounts and access during intrusions.

Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.