Procedure examples

Indrik Spider has used SSH for lateral movement.

GCMAN uses Putty for lateral movement.

Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.

Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.

TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

FIN7 has used SSH to move laterally through victim environments.

Rocke has spread its coinminer via SSH.

Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.

APT39 used secure shell (SSH) to move laterally among their targets.

UNC3886 has established remote SSH access to targeted ESXi hosts.

OilRig has used Putty to access compromised systems.

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.

BlackTech has used Putty for remote access.

Leviathan used ssh for internal reconnaissance.

APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.

Fox Kitten has used the PuTTY and Plink tools for lateral movement.

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.