Procedure examples

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.

During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.

During Frankenstein, the threat actors used Empire to gather various local system information.

During Operation Honeybee, the threat actors collected data from compromised hosts.

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.

During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to automatically gather sensitive data stored within the local system to include credentials, system configurations and sensitive operational data.

During C0015, the threat actors obtained files and data from the compromised network.

During the SolarWinds Compromise, APT29 extracted files from compromised networks.

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.

During Night Dragon, the threat actors collected files and other data from compromised systems.

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.

During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.

During C0026, the threat actors collected documents from compromised hosts.

During CostaRicto, the threat actors collected data and files from compromised networks.