Procedure examples

Storm-0501 has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.

APT29 uses stolen tokens to access victim accounts, without needing a password.

APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".

TeamPCP has used malware to steal access tokens from targeted cloud and developer environments.

ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository. Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.

APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.

Medusa Group has manually turned off and encrypted virtual machines.

Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.

HAFNIUM has exfitrated data from OneDrive.

Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.

Storm-0501 had modified Azure Storage account resources through the `Microsoft.Storage/storageAccounts/write` operation to expose non-remotely accessible accounts for data exfiltration.

APT42 has collected data from Microsoft 365 environments.

Fox Kitten has obtained files from the victim's cloud storage instances.

ShinyHunters has collected data from insecure cloud buckets.

Akira deletes administrator accounts in victim networks prior to encryption.

LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.

Storm-0501 has copied data from the victims environment to their own infrastructure leveraging AzCopy CLI.

RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.

INC Ransom has used Megasync to exfiltrate data to the cloud.

Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.

Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.

Evilnum can steal cookies and session information from browsers.

Sandworm Team used information stealer malware to collect browser session cookies.

Scattered Spider retrieves browser cookies via Raccoon Stealer.

Lotus Blossom has used publicly-available tools to steal cookies from browsers such as Chrome.

Star Blizzard has used EvilGinx to steal the session cookies of victims directed to
phishing domains.

LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.

APT42 has used custom malware to steal login and cookie data from common browsers.

Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.

APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.

Contagious Interview has established persistence using InvisibleFerret malware to create file to run the script on Startup via LaunchAgents. Contagious Interview has also utilized a plist file located in `/Library/LaunchAgents` to enable a malicious bash script the ability to persist.

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.

Rocke has installed a systemd service script to maintain persistence.

Scattered Spider has run `SYSTEMD_UNIT_PATH="/lib/systemd/
system/teleport.service` to establish persistence for the Teleport remote access tool.

TeamPCP has used the systemd user service for malware persistence in targeted environments.

APT38 has installed a new Windows service to establish persistence.

BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.

APT3 has a tool that creates a new service for persistence.

Kimsuky has created new services for persistence.

APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.