Procedure examples

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.

Dark Caracal spearphished victims via Facebook and Whatsapp.

Windshift has used fake personas on social media to engage and target victims.

ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.

Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.

Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.

Ajax Security Team has used various social media channels to spearphish victims.

Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.

BlackByte has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.

Contagious Interview has leveraged Telegram API to exfiltrate stolen data.

APT28 can exfiltrate data over Google Drive.

Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.

ShinyHunters has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.

Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.

Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts. Kimsuky has also leveraged Dropbox for uploading victim system information.

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.

FIN7 has exfiltrated stolen data to the MEGA file sharing site.

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using `curl`.

ZIRCONIUM has exfiltrated stolen data to Dropbox.

Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.

Contagious Interview has exfiltrated stolen passwords to Dropbox.

Akira will exfiltrate victim data using applications such as Rclone.

POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.

Confucius has exfiltrated victim data to cloud storage service accounts.

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.

Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.

Storm-0501 has exfiltrated stolen data to the MEGA file sharing site. Storm-0501 has also utilized Rclone to exfiltrate data from victim environments to cloud storage such as MegaSync. Storm-0501 has exfiltrated data to their own infrastructure utilizing AzCopy Command-Line tool (CLI).

Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.

Chimera has exfiltrated stolen data to OneDrive accounts.

Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.

Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as `mega.nz`.

ToddyCat has used a DropBox uploader to exfiltrate stolen files.

LuminousMoth has exfiltrated data to Google Drive.

Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.

Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.

HEXANE has used cloud services, including OneDrive, for data exfiltration.

Threat Group-3390 has exfiltrated stolen data to Dropbox.

Kimsuky has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.

RedEcho used dynamic DNS domains associated with malicious infrastructure.

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

TA2541 has used dynamic DNS services for C2 infrastructure.

BITTER has used DDNS for C2 communications.

APT29 has used Dynamic DNS providers for their malware C2 infrastructure.

APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.

Transparent Tribe has used dynamic DNS services to set up C2.

menuPass has used dynamic DNS service providers to host malicious domains.

Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.

TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.