Procedure examples

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

EXOTIC LILY has established social media profiles to mimic employees of targeted companies.

APT32 has set up Facebook pages in tandem with fake websites.

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.

Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Leviathan has created new social media accounts for targeting efforts.

Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.

Medusa Group has created social media accounts including Telegram and X to publicize their activities.

Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.

Water Galura operates a news channel on Telegram to make announcements for the Qilin RaaS.

Fox Kitten has used a Twitter account to communicate with ransomware victims.

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.

Moonstone Sleet has created social media accounts to interact with victims.

VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

TeamPCP has used its own Telegram channel and X accounts @pcpcats and @xploitrsturtle2 for external communications.