Procedure examples

Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.

Sandworm Team used various third-party email campaign management services to deliver phishing emails.

Contagious Interview has used services such as Astrill VPN.

Sea Turtle accessed victim networks from VPN service provider networks.

Star Blizzard has used HubSpot and MailerLite marketing platform services to hide the true sender of phishing emails.

Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.

Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.

In May 2026 TeamPCP announced co-ownership of the BreachForums cybercriminal forum claiming responsibility for platform operations, dispute resolution, personnel vetting, and hosting monetary contests.

APT38 has created fake domains to imitate legitimate venture capital or bank domains.

Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.

EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.

Dragonfly has registered domains for targeting intended victims.

menuPass has registered malicious domains for use in intrusion campaigns.

APT32 has set up and operated websites to gather information and deliver malware.

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.

RedEcho has registered domains spoofing Indian critical infrastructure entities.

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Storm-1811 has created domains for use with RMM tools.

TeamTNT has obtained domains to host their payloads.

FIN7 has registered look-alike domains for use in phishing campaigns. Additionally, FIN7 has registered a malicious domain as `advanced-ip-sccanner[.]com` that redirected to an adversary-controlled Dropbox which contained the malicious executable.

Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.

CURIUM created domains to facilitate strategic website compromise and credential capture activities.

Mustang Panda has acquired C2 domains prior to operations.

ZIRCONIUM has purchased domains for use in targeted campaigns.

Scattered Spider has registered domains to spoof legitimate corporate login portals.

Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.

TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.

OilRig has set up fake VPN portals, conference sign ups, and job application websites to target victims.

Sea Turtle registered domains for authoritative name servers used in DNS hijacking activity and for command and control servers.

Ferocious Kitten has acquired domains imitating legitimate sites.

APT1 has registered hundreds of domains for use in operations.

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.

Winter Vivern registered domains mimicking other entities throughout various campaigns.

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.

BITTER has registered a variety of domains to host malicious payloads and for C2.

Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.

Star Blizzard has registered domains using randomized words and with names resembling legitimate organizations.

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.

APT42 has registered domains, several of which masqueraded as news outlets and login services, for use in operations.

APT-C-36 has acquired domains to host malicious payloads.

Winnti Group has registered domains for C2 that mimicked sites of their intended targets.

Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.

Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.

IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.

Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.

VOID MANTICORE has registered domains for messaging purposes. VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion. VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex. VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.

WIRTE has registered domains designed to mimic legitimate sites for use in phishing campaigns.