Procedure examples

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.

Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.

TA578 has used Google Firebase to host malicious scripts.

LazyScripter has established GitHub accounts to host its toolsets.

APT28 has used newly-created Blogspot pages for credential harvesting operations.

APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.

Lazarus Group has hosted malicious downloads on Github.

Earth Lusca has established GitHub accounts to host their malware.

IndigoZebra created Dropbox accounts for their operations.

VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity. VOID MANTICORE has also leveraged Starlink internet services. VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.

Magic Hound has acquired Amazon S3 buckets to use in C2.

TeamPCP has set up Clouflare Tunnels for malware C2. TeamPCP has also used the session messenger network for decentralized, encrypted exfiltration via  *.getsession[.]org to recipient  ID `05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026`.

Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware.

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.

Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.

Kimsuky has compromised legitimate sites and used them to distribute malware.

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.

Transparent Tribe has compromised domains for use in targeted malicious campaigns.

Magic Hound has used compromised domains to host links targeted to specific phishing victims.

Sea Turtle modified Name Server (NS) items to refer to Sea Turtle-controlled DNS servers to provide responses for all DNS lookups.

LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.

Volt Typhoon has compromised Virtual Private Servers (VPS) to proxy C2 traffic.

Turla has used the VPS infrastructure of compromised Iranian threat actors.

Indrik Spider has served fake updates via legitimate websites that have been compromised.

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.

Dragonfly has compromised legitimate websites to host C2 and malware modules.

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.

Leviathan has used compromised legitimate websites as command and control nodes for operations.

Turla has used compromised servers as infrastructure.

Lazarus Group has compromised servers to stage malicious tools.

Earth Lusca has used compromised web servers as part of their operational infrastructure.

APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.

Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.

HAFNIUM has used compromised devices in covert networks to obfuscate communications.

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.

Axiom has used large groups of compromised machines for use as proxy nodes.

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.

CURIUM has compromised legitimate websites to enable strategic website compromise attacks.

Winter Vivern has used compromised WordPress sites to host malicious payloads for download.

Turla has frequently used compromised WordPress sites for C2 infrastructure.

Earth Lusca has compromised Google Drive repositories.

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.

ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.

Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.

APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.

APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.

Kimsuky has leveraged stolen PII to create accounts.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Ember Bear has created accounts on dark web forums to obtain various tools and malware.