Procedure examples

FIN10 has used RDP to move laterally to systems in the victim environment.

FIN8 has used RDP for lateral movement.

FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.

BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.

APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.

APT41 has transferred implant files using Windows Admin Shares and the Server Message Block (SMB) protocol, then executes files through Windows Management Instrumentation (WMI).

APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.

Storm-1811 has attempted to move laterally in victim environments via SMB using Impacket.

Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.

APT39 has used SMB for lateral movement.

Moses Staff has used batch scripts that can enable SMB on a compromised host.

Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.

Aquatic Panda used remote shares to enable lateral movement in victim environments.

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.

Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.

Turla used net use commands to connect to lateral systems within a network.

Cinnamon Tempest has used SMBexec for lateral movement.

Chimera has used Windows admin shares to move laterally.

MirrorFace has used SMB to copy malware between systems in compromised environments.

Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials.

ToddyCat has used locally mounted network shares for lateral movement through targated environments.

APT28 has mapped network drives using Net and administrator credentials.

Fox Kitten has used valid accounts to access SMB shares.

Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.

Threat Group-1314 actors mapped network drives using net use.

Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.

Velvet Ant has transferred tools within victim environments using SMB.

Play has used Cobalt Strike to move laterally via SMB.

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.

FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.

Indrik Spider has used SSH for lateral movement.

GCMAN uses Putty for lateral movement.

Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.

Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.

TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

FIN7 has used SSH to move laterally through victim environments.

Rocke has spread its coinminer via SSH.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

APT39 used secure shell (SSH) to move laterally among their targets.

UNC3886 has established remote SSH access to targeted ESXi hosts.

OilRig has used Putty to access compromised systems.

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.

BlackTech has used Putty for remote access.

Leviathan used ssh for internal reconnaissance.

APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.

Fox Kitten has used the PuTTY and Plink tools for lateral movement.

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.

GCMAN uses VNC for lateral movement.