Procedure examples

During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.

During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network.

During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.

During the 2025 Poland Wiper Attacks, the adversaries had placed the malicious payload on an accessible network share to facilitate propagation.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.

During Operation Wocao, threat actors used SMB to copy files to and from target systems.

During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable `msserver.exe` from a staging server to a local hard drive before deployment.