Procedure examples

FIN13 has observed the victim's software and infrastructure over several months to understand the technical process of legitimate financial transactions, prior to attempting to conduct fraudulent transactions.

TeamPCP has engaged in cryptocurrency mining and theft. TeamPCP has also partnered with ransomware and data theft extortion groups, sold leaked code, and crowdsourced supply chain compromises by open-sourcing their Mini Shai-Hulud malware.

ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.

MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.

ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to obfuscate the origin of C2 traffic.

APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.

Storm-1811 has deployed large volumes of non-malicious email spam to victims in order to prompt follow-on interactions with the threat actor posing as IT support or helpdesk to resolve the problem.

APT28 has exploited open Wi-Fi access points for initial access to target devices using the network.

UNC3886 has used scripts to enumerate ESXi hypervisors and their guest VMs.

FIN7 has used malicious USBs to emulate keystrokes to launch PowerShell to download and execute malware from the adversary's server.

UNC3886 used `vmtoolsd.exe` to run commands on guest virtual machines from a compromised ESXi host.

TeamPCP has compromised trusted CI/CD pipelines by injecting credential-stealing payloads into legitimate workflows and software packages including open-source security tools Trivy and KICS, and AI gateway LiteLLM.

Kimsuky has utilized the Sleep function to ensure execution of scripts.

Mustang Panda has delayed the execution of payloads leveraging ping echo requests `cmd /c ping 8.8.8.8 -n 70&&"%temp%\<legitimate executable>"`.

VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.

Kimsuky has enumerated drives.

Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.

Patchwork enumerated all available drives on the victim's machine.

TeamTNT has searched for disk partition and logical volume information.

Higaisa collected the system volume serial number.

Tropic Trooper has detected a target system’s system volume information.

Confucius has used a file stealer that can examine system drives, including those other than the C drive.

Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.

ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.

UNC3886 has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.

Contagious Interview has registered accounts with Threat Intelligence vendor services to check for reporting associated with their infrastructure and to evaluate new potential infrastructure.

Kimsuky has used LLMs to identify think tanks, government organizations, and experts to inform targeting for spearphishing campaigns.

APT42 has leveraged LLMs to search for official emails to build target lists, and conduct reconnaissance on potential business partners.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.

TeamPCP has created Dune-themed GitHub repositories using stolen tokens.

Contagious Interview has used AI to clone video-conferencing applications to distribute their BeaverTail malware. They have also used AI to create deepfake videos.

APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.

ShinyHunters has used social engineering to demand payment from victims.

Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee. Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.

APT41 impersonated an employee at a video game developer company to send phishing emails.

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.

Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.

Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.

Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.

Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.

LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials.

APT42 has impersonated legitimate people in phishing emails to gain credentials.

APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.

LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.

VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.

WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.