Procedure examples

Mustang Panda has used revoked code signing certificates for its malicious payloads.

OilRig has obtained stolen code signing certificates to digitally sign malware.

BlackTech has used stolen code-signing certificates for its malicious payloads.

Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.

FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.

Mustang Panda has obtained SSL certificates for their C2 domains.

UNC3886 has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.

Sea Turtle created new certificates using a technique called the actors performed "certificate impersonation," a technique in which Sea Turtle obtained a certificate authority-signed X.509 certificate from another provider for the same domain imitating the one already used by the targeted organization.

BlackTech has used valid, stolen digital certificates for some of their malware and tools.

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.

LuminousMoth has used a valid digital certificate for some of their malware.

Lazarus Group has obtained SSL certificates for their C2 domains.

Kimsuky has obtained exploit code for various CVEs.

Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.

Volt Typhoon has used publicly available exploit code for initial access.

In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.

Storm-0501 has obtained capabilities to exploit N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).

Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.

APT28 has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.

ShinyHunters has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.

Volt Typhoon has gathered victim identify information during pre-compromise reconnaissance.

APT32 has conducted targeted surveillance against activists and bloggers.

Scattered Spider has used information from previous data breaches to identify employee names to be used in social engineering.

Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.

Star Blizzard has identified ways to engage targets by researching potential victims' interests and social or professional contacts.

LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.

VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.

HEXANE has identified specific potential victims at targeted organizations.

Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.

FIN13 has researched employees to target for social engineering attacks.

Leviathan has collected compromised credentials to use for targeting efforts.

Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.

APT28 has harvested user's login credentials.

LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.

Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.

ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.

Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.

EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.

Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.

APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.

HAFNIUM has collected e-mail addresses for users they intended to target.

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Saint Bear gathered victim email information in advance of phishing operations for targeted attacks.

Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.

TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.

Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.

LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.

Moonstone Sleet gathered victim email address information for follow-on phishing activity.

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.