Procedure examples

During SharePoint ToolShell Exploitation, threat actors decrypted scripts prior to execution.

During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.

During RedPenguin, UNC3886 used malware implants to deobfuscate incoming C2 messages and encoded archives.

During Operation Honeybee, malicious files were decoded prior to execution.

During Operation Dust Storm, attackers used VBS code to decode payloads.

For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.

Water Curupira Pikabot Distribution used highly obfuscated JavaScript files as one initial installer for Pikabot.

During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.

During Juicy Mix, OilRig used a script to concatenate and deobfuscate encoded strings in Mango.

During the SolarWinds Compromise, APT29 used 7-Zip to decode their Raindrop malware.

During APT28 Nearest Neighbor Campaign, APT28 unarchived data using the GUI version of WinRAR.

ArcaneDoor involved the use of Base64 obfuscated scripts and commands.

During the 2025 Poland Wiper Attacks, the adversaries decoded a Base64-encoded ZIP archive using the built-in certutil.

During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.