Procedure examples

During C0015, the threat actors collected files from network shared drives prior to network encryption.

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

RedCurl has collected data about network drives.

Chimera has collected data of interest from network shares.

BRONZE BUTLER has exfiltrated files stolen from file shares.

APT28 has collected files from network shared drives.

Fox Kitten has searched network shares to access sensitive documents.

Sowbug extracted Word documents from a file server on a victim network.

CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.

Ramsay can collect data from network drives and stage it for exfiltration.

Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.

When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

During RedPenguin, UNC3886 used a passive backdoor to act as a libpcap-based packet sniffer.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems.

ArcaneDoor included network packet capture and sniffing for data collection in victim environments.

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.

Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.

Sandworm Team has used intercepter-NG to sniff passwords in network traffic.

UNC3886 has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.

DarkVishnya used network sniffing to obtain login data.

APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.

Velvet Ant has used a custom tool, "VELVETTAP", to perform packet capture from compromised F5 BIG-IP devices.

APT33 has used SniffPass to collect credentials by sniffing network traffic.

cd00r can use the libpcap library to monitor captured packets for specifc sequences.

JumbledPath has the ability to perform packet capture on remote devices via actor-defined jump-hosts.

VersaMem hooked the Catalina application filter chain `doFilter` on compromised systems to monitor all inbound requests to the local Tomcat web server, inspecting them for parameters like passwords and follow-on Java modules.

CASTLETAP has the ability to create a raw promiscuous socket to sniff network traffic.

J-magic has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.

Emotet has been observed to hook network APIs to monitor network traffic.

Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.

Line Dancer can create and exfiltrate packet captures from compromised environments.

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.

Penquin can sniff network traffic to look for packets matching specific conditions.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

Impacket can be used to sniff network traffic via an interface or raw socket.

Empire can be used to conduct packet captures on target hosts.

PoshC2 contains a module for taking packet captures on compromised hosts.

Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.

NBTscan can dump and print whole packet content.

During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.

During SharePoint ToolShell Exploitation, threat actors exfiltrated stolen credentials and internal data over HTTPS to C2 infrastructure.

During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.

During RedPenguin, UNC3886 uploaded specified files from compromised devices to a remote server.

During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.

During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.

ArcaneDoor included use of existing command and control channels for data exfiltration.

During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.

Leviathan exfiltrated collected data over existing command and control channels during Leviathan Australian Intrusions.