Procedure examples

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.

Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.

Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.

UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.

TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.

Aquatic Panda has acquired and used njRAT in its operations.

APT1 used publicly available malware for privilege escalation.

Turla has used malware obtained after compromising other threat actors, such as OilRig.

TA505 has used malware such as Azorult and Cobalt Strike in their operations.

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

Ember Bear has acquired malware and related tools from dark web forums.

LazyScripter has used a variety of open-source remote access Trojans for its operations.

LuminousMoth has obtained and used malware such as Cobalt Strike.

Metador has used unique malware in their operations, including metaMain and Mafalda.

APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.

Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.

LAPSUS$ acquired and used the Redline password stealer in their operations.

VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.