Procedure examples

Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

FIN7 has used TightVNC to control compromised hosts.

Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.

Storm-0501 has utilized the post-exploitation tool known as Evil-WinRM that uses PowerShell over Windows Remote Management (WinRM) for remote code execution.

Chimera has used WinRM for lateral movement.

Wizard Spider has used Window Remote Management to move laterally through a victim network.

Threat Group-3390 has used WinRM to enable remote execution.

FIN13 has leveraged `WMI` to move laterally within a compromised network via application servers and SQL servers.

Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.

Storm-0501 has used compromised Entra Connect Sync Server to move laterally within the victim environment.

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.

Turla RPC backdoors can collect files from USB thumb drives.

An APT28 backdoor may collect the entire contents of an inserted USB device.

GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.

APT3 obfuscates files or information to help evade defensive measures.

Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format. Kimsuky has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions that complicate static analysis.

APT41 used VMProtected binaries in multiple intrusions.

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments. Additionally, Gamaredon Group has used an obfuscated .drv file.

Gallmaker obfuscated shellcode used during execution.

Sandworm Team has used Base64 encoding within malware variants.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

Rocke has modified UPX headers after packing files to break unpackers.

APT37 obfuscates strings and payloads.

Ke3chang has used Base64-encoded shellcode strings.

RedCurl has used malware with string encryption. RedCurl has also encrypted data and has encoded PowerShell commands using Base64. RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.

BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.

Windshift has used string encoding with floating point calculations.

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.

Earth Lusca used Base64 to encode strings.

BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.

Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.

Kimsuky has performed padding of PowerShell command line code with over 100 spaces.

Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Moafee has been known to employ binary padding.

Akira has used binary padding to obfuscate payloads.

Higaisa performed padding with null bytes before calculating its hash.

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.

Elderwood has packed malware payloads before delivery to victims.

GALLIUM packed some payloads using different types of packers, both known and custom.

APT3 has been known to pack their tools.

Kimsuky has packed malware with UPX.

Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.

A Patchwork payload was packed with UPX.

APT41 uses packers such as Themida to obfuscate malicious files.

TeamTNT has used UPX and Ezuri packer to pack its binaries.