Procedure examples

Strider has used a hidden file system that is stored as a file on disk.

Equation has used an encrypted virtual file system stored in the Windows Registry.

Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.

FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.

Kimsuky has leveraged the PowerShell `-ErrorAction SilentlyContinue` command to continue execution through system events.

UNC3886 modified the startup file `/etc/init.d/localnet` to execute the line `nohup /bin/support &` so the script would run when the system was rebooted.

Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.

Turla has placed LunarWeb install files into directories that are excluded from scanning.

FIN13 has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.

Kimsuky has used spearphishing to gain initial access and intelligence.

AppleJeus has used spearphishing emails to distribute malicious payloads.

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.

Sea Turtle used spear phishing to gain initial access to victims.

Axiom has used spear phishing to initially compromise victims.

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.

INC Ransom has used phishing to gain initial access.

VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector.

APT38 has conducted spearphishing campaigns using malicious email attachments.

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.

SideCopy has sent spearphishing emails with malicious hta file attachments.

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns. Kimsuky has also distributed emails with attached compressed zip files that contained malicious .LNK files masquerading as legitimate files. Kimsuky has delivered tailored PDF documents that contain malicious links.

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.

admin@338 has sent emails with malicious Microsoft Office documents attached.

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

Dragonfly has sent emails with malicious attachments to gain initial access.

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

Naikon has used malicious e-mail attachments to deliver malware.

FIN6 has targeted victims with e-mails containing malicious attachments.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gallmaker sent emails with malicious Microsoft Office documents attached.

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.

CURIUM has used phishing with malicious attachments for initial access to victim environments.

Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.

Mustang Panda has used spearphishing attachments to deliver initial access payloads. Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.

TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.

APT37 delivers malware using spearphishing emails with malicious HWP attachments.

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

Higaisa has sent spearphishing emails containing malicious attachments.

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.