Procedure examples

Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.

Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.

TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.

Aquatic Panda has acquired and used njRAT in its operations.

APT1 used publicly available malware for privilege escalation.

Turla has used malware obtained after compromising other threat actors, such as OilRig.

TA505 has used malware such as Azorult and Cobalt Strike in their operations.

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

Ember Bear has acquired malware and related tools from dark web forums.

LazyScripter has used a variety of open-source remote access Trojans for its operations.

LuminousMoth has obtained and used malware such as Cobalt Strike.

Metador has used unique malware in their operations, including metaMain and Mafalda.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.

LAPSUS$ acquired and used the Redline password stealer in their operations.

VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.

APT38 has obtained and used open-source tools such as Mimikatz.

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.

Patchwork has obtained and used open-source tools such as QuasarRAT.

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.

Salt Typhoon has used publicly available tooling to exploit vulnerabilities.

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.

Contagious Interview has used remote management and monitoring software such as “AnyDesk”.

TA2541 has used commodity remote access tools.

Moses Staff has used the commercial tool DiskCryptor.

OilRig has made use of the publicly available tools including Plink and Mimikatz.

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.

Sea Turtle has used tools such as Adminer during intrusions.

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.

Aquatic Panda has acquired and used Cobalt Strike in its operations.

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.

Ke3chang has obtained and used tools such as Mimikatz.

APT1 has used various open-source tools for privilege escalation purposes.