Procedure examples

APT28 has used compromised email accounts to send credential phishing emails.

APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.

LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

HEXANE has used compromised accounts to send spearphishing emails.

WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.

APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.

Kimsuky created and used a mailing toolkit to use in spearphishing attacks.

Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.

Moonstone Sleet developed malicious npm packages for delivery to or retrieval by victims.

Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Salt Typhoon has used custom tooling including JumbledPath.

TeamTNT has developed custom malware such as Hildegard.

FIN7 has developed malware for use in operations, including the creation of infected removable media.

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Mustang Panda has developed custom malware for use in their operations.

UNC3886 has deployed custom malware families on Fortinet and VMware systems.

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.

Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.

OilRig actively developed and used a series of downloaders during 2022.

Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Turla has developed its own unique malware for use in operations.

RedCurl has created its own tools to use during operations.

APT29 has used unique malware in many of their operations.

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.

Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

LuminousMoth has used unique malware for information theft and exfiltration.

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.

Lazarus Group has developed custom malware for use in their operations.

Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.

VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.

Play developed and employ Playcrypt ransomware.

FIN13 has utilized custom malware to maintain persistence in a compromised environment.

TeamPCP has developed and deployed custom malware including TeamPCP Cloud Stealer, CanisterWorm, and Mini Shai-Hulud.

Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.

PROMETHIUM has created self-signed certificates to sign malicious installers.

Daggerfly created code signing certificates to sign malicious macOS files.

Gamaredon Group has used the same TLS certificate across its infrastructure.

Storm-0501 has utilized their own self-signed TLS certificate “Microsoft IT TLS CA 5” with their infrastructure.

APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.

Volt Typhoon has exploited zero-day vulnerabilities for initial access.

UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.

Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.

ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.