Procedure examples

Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.

Kimsuky has collected victim employee name information.

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.

Silent Librarian has collected lists of names for individuals from targeted organizations.

Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.

Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.

Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.

FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.

Andariel has limited its watering hole attacks to specific IP address ranges.

Magic Hound has captured the IP addresses of visitors to their phishing sites.

Volt Typhoon has identified target network security measures as part of pre-compromise reconnaissance.

Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others. Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.

Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.

FIN7 has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.

MirrorFace has placed specific content in phishing emails to target members of particular political parties.

APT28 has used large language models (LLMs) to gather information about satellite capabilities.

Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.

Moonstone Sleet has gathered information on victim organizations through email and social media interaction.

Magic Hound has collected location information from visitors to their phishing sites.

Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.

In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.

LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.

Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.

FIN7 has identified IT staff and employees who had higher levels of administrative rights.

LAPSUS$ has gathered detailed knowledge of team structures within a target organization.

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.

Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.

Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.

Magic Hound has captured the user-agent strings from visitors to their phishing sites.

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.

Volt Typhoon has conducted pre-compromise web searches for victim information.

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.

Mustang Panda has used open-source research to identify information about victims to use in targeting to include creating weaponized phishing lures and attachments.

Contagious Interview has utilized open-source indicator of compromise repositories to determine their exposure to include VirusTotal, and MalTrail.

Star Blizzard has used open-source research to identify information about victims to use in targeting.

APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.

EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.

Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.

HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.

Contagious Interview had identified and solicited victims through code repositories such as GitHub.

LAPSUS$ has searched public code repositories for exposed credentials.

ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.