Procedure examples

Scattered Spider has stopped the Volume Shadow Copy service on compromised hosts.

Storm-0501 has deleted snapshots, restore points, storage accounts, and backup services to prevent remediation and restoration. Storm-0501 has also impacted Azure resources through the targeting of `Microsoft.Compute/snapshots/delete`,
`Microsoft.Compute/restorePointCollections/delete`,
`Microsoft.Storage/storageAccounts/delete`, and
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete`.

Medusa Group has deleted recovery files such as shadow copies using `vssadmin.exe`.

Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.

BlackByte left ransom notes in all directories where encryption takes place.

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.

Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.

ShinyHunters has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.

Ember Bear is linked to the defacement of several Ukrainian organization websites.

APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.

TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.

Rocke has distributed cryptomining malware.

Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.

Contagious Interview has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.

Saint Bear contains several anti-analysis and anti-virtualization checks.

Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.

Kimsuky has detected and killed virtual environments by using the PowerShell cmdlet `Get-CimInstance` that searches the classname of the computer system manufacturer through an if statement of `if($computerSystem.Manufacturer -match "VMware" -or $computerSystem.Manufacturer -match "Microsoft" -or $computerSystem.Manufacturer -match "VirtualBox")`.

Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.

Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.

Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.

OilRig has used macros to verify if a mouse is connected to a compromised machine.

Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.

WIRTE has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments.

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.

Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.

In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.

APT38 has used web shells for persistence or to ensure redundant access.

BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.

Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

APT32 has used Web shells to maintain access to victim websites.

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.

CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.

APT39 has installed ANTAK and ASPXSPY web shells.

Moses Staff has dropped a web shell onto a compromised system.

OilRig has used web shells, often to maintain access to a victim network.

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.

Sea Turtle deployed the SnappyTCP web shell during intrusion operations.

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

APT29 has installed web shells on exploited Microsoft Exchange servers.

Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.