Procedure examples

Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Salt Typhoon has used custom tooling including JumbledPath.

TeamTNT has developed custom malware such as Hildegard.

FIN7 has developed malware for use in operations, including the creation of infected removable media.

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Mustang Panda has developed custom malware for use in their operations.

UNC3886 has deployed custom malware families on Fortinet and VMware systems.

Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.

Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.

OilRig actively developed and used a series of downloaders during 2022.

Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Turla has developed its own unique malware for use in operations.

RedCurl has created its own tools to use during operations.

APT29 has used unique malware in many of their operations.

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.

Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

LuminousMoth has used unique malware for information theft and exfiltration.

APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.

Lazarus Group has developed custom malware for use in their operations.

Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.

VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.

Play developed and employ Playcrypt ransomware.

FIN13 has utilized custom malware to maintain persistence in a compromised environment.

TeamPCP has developed and deployed custom malware including TeamPCP Cloud Stealer, CanisterWorm, and Mini Shai-Hulud.