Procedure examples

Kimsuky has captured browser screenshots using TRANSLATEXT. Kimsuky has also obtained screen captures with custom malware.

Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

MuddyWater has used malware that can capture screenshots of the victim’s machine.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

FIN7 captured screenshots and desktop video recordings.

APT39 has used a screen capture utility to take screenshots on a compromised host.

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

MoustachedBouncer has used plugins to take screenshots on targeted systems.

Malware used by Group5 is capable of watching the victim's screen.

Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.

Dark Caracal took screenshots using their Windows malware.

BRONZE BUTLER has used a tool to capture screenshots.

APT28 has used tools to take screenshots from victims.

APT42 has used malware, such as GHAMBAR and POWERPOST, to take screenshots.

GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.

Silence can capture victim screen activity.

VOID MANTICORE has captured screen content during an active Zoom session.

Magic Hound malware can take a screenshot and upload the file to its C2 server.