Procedure examples

APT32's macOS backdoor hides the clientID file via a chflags function.

HAFNIUM has hidden files on a compromised host.

FIN7 has used `attrib +h “C:\ProgramData\ssh”` to make the SSH folder hidden.

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to `hidden` and `system`.

Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.

RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.

LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.

APT28 has saved files with hidden file attributes.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.

FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.

TeamPCP has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed malware.