Procedure examples

For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.

During RedPenguin, UNC3886 deployed custom malware based on the publicly-available TINYSHELL backdoor.

For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.

In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.

For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.

For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.

For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.

During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.

During Salesforce Data Exfiltration, threat actors created malicious applications within Salesforce trial accounts, typically Python scripts with similar function to the Salesforce Data Loader.

For Outer Space, OilRig created new implants including the Solar backdoor.

ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.

During the 2025 Poland Wiper Attacks, the adversaries observed that their malware was initially detected by the victims EDR solutions, so they modified the payload and attempted to execute the new version within the same day.

For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.

Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.

During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.

For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.