Procedure examples

Kimsuky has searched for information on the target company's website.

EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.

Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.

Sandworm Team has conducted research against potential victim websites as part of its operational planning.

Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.

TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.

TeamTNT has scanned specific lists of target IP addresses.

Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.

Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.

Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.

Volatile Cedar has performed vulnerability scans of the target server.

APT28 has performed large-scale scans in an attempt to find vulnerable servers.

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.

ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.

APT41 leverages various tools and frameworks to brute-force directories on web servers.

Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.

Kimsuky has used LLMs to better understand publicly reported vulnerabilities.

APT28 has used large language models (LLMs) to assist in script development and deployment.

Volt Typhoon has used FOFA, Shodan, and Censys to search for exposed victim infrastructure.

APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.

EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.

LAPSUS$ has purchased credentials and session tokens from criminal underground forums.

Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.

Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.

APT28 has used spearphishing to compromise credentials.

Moonstone Sleet has interacted with victims to gather information via email.

ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.

Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.

Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with attachments containing links to credential-stealing sites.

Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.

Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.

Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.

APT32 has used malicious links to direct users to web pages designed to harvest credentials.

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.

CURIUM used malicious links to adversary-controlled resources for credential harvesting.

Sidewinder has sent e-mails with malicious links to credential harvesting websites.

Mustang Panda has delivered web bugs to profile their intended targets.

ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.