Procedure examples

Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.

HEXANE has used `net view` to enumerate domain machines.

Magic Hound has used Ping for discovery on targeted networks.

Threat Group-3390 has used the net view command.

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

ShinyHunters has enumerated the internal subnet using ` cat /etc/hosts | grep -E "[redacted_victim_string]"`.

Kimsuky has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

RedCurl has used batch scripts to exfiltrate data.

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.

Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.

Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.

Indrik Spider has used RDP for lateral movement.

BlackByte has used RDP to access other hosts within victim networks.

APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

Kimsuky has used RDP for direct remote point-and-click access.

Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.

Patchwork attempted to use RDP to move laterally.

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

Dragonfly has moved laterally via RDP.

menuPass has used RDP connections to move across the victim network.

FIN6 used RDP to move laterally in victim networks.

FIN7 has used RDP to move laterally in victim environments.

Scattered Spider has used RDP to enable lateral movement.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

Akira has used RDP for lateral movement.

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.

The APT1 group is known to have used RDP during operations.

Leviathan has targeted RDP credentials and used it to move through the victim environment.

Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.

Chimera has used RDP to access targeted systems.

MirrorFace has used RDP to exfiltrate files of interest.

Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.

Axiom has used RDP during operations.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

APT5 has moved laterally throughout victim environments using RDP.

Fox Kitten has used RDP to log in and move laterally in the target environment.

Lazarus Group malware SierraCharlie uses RDP for propagation.

INC Ransom has used RDP to move laterally.

Silence has used RDP for lateral movement.

Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

VOID MANTICORE has used RDP to move laterally within the victim environment.

HEXANE has used remote desktop sessions for lateral movement.

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.