Procedure examples

Storm-0501 has used Windows native utility Nltest `nltest.exe` for discovery.

Lotus Blossom has used tools such as AdFind to make Active Directory queries.

Chimera has nltest /domain_trusts to identify domain trust relationships.

MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships.

Earth Lusca has used Nltest to obtain information about domain controllers.

Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.

FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.

Indrik Spider has used Group Policy Objects to deploy batch scripts.

APT41 used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.

Storm-0501 distributed Group Policy Objects to tamper with security products.

Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.

Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.

Storm-0501 created a new federated domain within the victim Microsoft Entra tenant using Global Administrator level access to establish a persistent backdoor for later use.

APT38 has used a custom secure delete function to make deleted files unrecoverable.

Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes.

Storm-0501 has destroyed data and backup files.

Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.

LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.

VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.

TeamPCP has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive file deletions on non-containerized hosts.

ShinyHunters has executed the `DeleteBucket` API call to delete buckets.

APT38 has used Hermes ransomware to encrypt files with AES256.

Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.

BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.

Storm-1811 is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.

Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.

Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.

Akira encrypts files in victim environments as part of ransomware operations.

Storm-0501 has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 and Embargo ransomware.

TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.

Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Water Galura has encrypted files on victim networks through the generation of Qilin ransomware payloads.

INC Ransom has used INC Ransomware to encrypt victim's data.

Moonstone Sleet has deployed ransomware in victim environments.

VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.

Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.

TeamPCP has deployed ransomware and has announced partnerships with ransomware groups including Vect and CipherForce in online criminal forums.

Indrik Spider has used PsExec to stop services prior to the execution of ransomware.

Kimsuky has disabled actively running virtual environments using the `KillMe` function to include VMware, Microsoft Hypervisors, and VirtualBox.

Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.

Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.

Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.

LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.

BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.

Sandworm Team uses Prestige to delete the backup catalog from the target system using: `C:\Windows\System32\wbadmin.exe delete catalog -quiet` and to delete volume shadow copies using: `C:\Windows\System32\vssadmin.exe delete shadows /all /quiet`.