Procedure examples

Fox Kitten has created KeyBase accounts to communicate with ransomware victims.

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

EXOTIC LILY has established social media profiles to mimic employees of targeted companies.

APT32 has set up Facebook pages in tandem with fake websites.

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.

Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Leviathan has created new social media accounts for targeting efforts.

Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.

Medusa Group has created social media accounts including Telegram and X to publicize their activities.

Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.

Water Galura operates a news channel on Telegram to make announcements for the Qilin RaaS.

Fox Kitten has used a Twitter account to communicate with ransomware victims.

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.

Moonstone Sleet has created social media accounts to interact with victims.

VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

TeamPCP has used its own Telegram channel and X accounts @pcpcats and @xploitrsturtle2 for external communications.

Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.

Kimsuky has created email accounts for phishing operations.

EXOTIC LILY has created e-mail accounts to spoof targeted organizations.

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.

CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns. Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails. Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail.

Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.

Leviathan has created new email accounts for targeting efforts.

Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.

Medusa Group has created email accounts used in ransomware negotiations.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.

APT42 has created email accounts to use in spearphishing operations.

Lazarus Group has created new email accounts for spearphishing operations.

Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.

Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.

VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.

Magic Hound has established email accounts using fake personas for spearphishing operations.

ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.

Storm-1811 has created malicious accounts to enable activity via Microsoft Teams, typically spoofing various IT support and helpdesk themes.

Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.

Leviathan has compromised social media accounts to conduct social engineering attacks.

Kimsuky has compromised email accounts to send spearphishing e-mails.

TA577 has sent thread hijacked messages from compromised emails.

Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.

OilRig has compromised email accounts to send phishing emails.

Leviathan has compromised email accounts to conduct social engineering attacks.

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.

Star Blizzard has used compromised email accounts to conduct spearphishing against
contacts of the original victim.