Procedure examples

APT38 has obtained and used open-source tools such as Mimikatz.

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.

Patchwork has obtained and used open-source tools such as QuasarRAT.

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.

Salt Typhoon has used publicly available tooling to exploit vulnerabilities.

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.

Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.

Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.

Contagious Interview has used remote management and monitoring software such as “AnyDesk”.

TA2541 has used commodity remote access tools.

Moses Staff has used the commercial tool DiskCryptor.

OilRig has made use of the publicly available tools including Plink and Mimikatz.

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.

Sea Turtle has used tools such as Adminer during intrusions.

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.

Aquatic Panda has acquired and used Cobalt Strike in its operations.

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.

Ke3chang has obtained and used tools such as Mimikatz.

APT1 has used various open-source tools for privilege escalation purposes.

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.

BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.

Blue Mockingbird has obtained and used tools such as Mimikatz.

Turla has obtained and customized publicly-available tools like Mimikatz.

TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.

BITTER has obtained tools such as PuTTY for use in their operations.

DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.

Lotus Blossom has used publicly-available tools such as a Python-based cookie stealer for Chrome browsers, Impacket, and the Venom proxy tool.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.

Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.

Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning. Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery. Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.