Procedure examples

During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.

During SharePoint ToolShell Exploitation, threat actors registered C2 domains to spoof legitimate Microsoft domains.

Mustang Panda registered adversary-controlled domains during RedDelta Modified PlugX Infection Chain Operations that were re-registrations of expired domains.

During Operation Honeybee, threat actors registered domains for C2.

For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.

During Indian Critical Infrastructure Intrusions, RedEcho registered domains spoofing Indian critical infrastructure entities.

For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.

For C0021, the threat actors registered domains for use in C2.

For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.

For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.

For FunnyDream, the threat actors registered a variety of domains.

For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.

For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.

For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.

For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.