Procedure examples

Scattered Spider has used domains mirroring corporate login portals to socially engineer victims into providing credentials.

Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.

Star Blizzard has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.

Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.

Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.

ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.

Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.

LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.

APT41 used `NATBypass` to bypass firewall restrictions and to access compromised systems via RDP.

Salt Typhoon has attempted to acquire credentials by dumping network device configurations.

Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.

BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.

SideCopy has used compromised domains to host its malicious payloads.

Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants. Kimsuky has also hosted malicious payloads on Dropbox.

EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.

Gamaredon Group has registered domains to stage payloads.

TeamTNT has uploaded backdoored Docker images to Docker Hub.

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3. FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.

Mustang Panda has hosted malicious payloads on DropBox including PlugX.

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.

TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.

OilRig has hosted malware on fake websites designed to target specific audiences.

Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.

TA505 has staged malware on actor-controlled domains.

BITTER has registered domains to stage payloads.

Star Blizzard has uploaded malicious payloads to cloud storage sites.

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.

LuminousMoth has hosted malicious payloads on Dropbox.

APT42 has used its infrastructure for C2 and for staging the VINETHORN payload, which masqueraded as a VPN application.

APT-C-36 has staged malware implants on group-owned repositories and sites.

Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.

Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.

WIRTE has directed victims to malicious payloads staged on file sharing services.

Threat Group-3390 has hosted malicious payloads on Dropbox.

TeamPCP has pushed GitHub commits that modified the actions/checkout to reference an imposter commit that downloaded malicious files from attacker-controlled C2 domains.

Medusa Group has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.

Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.

Sea Turtle captured legitimate SSL certificates from victim organizations and installed these on Sea Turtle-controlled infrastructure to enable subsequent adversary-in-the-middle operations.

Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.

Dragonfly has compromised websites to redirect traffic and to host exploit kits.

APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.

FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.

CURIUM used strategic website compromise to fingerprint then target victims.

LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.