Procedure examples

APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.

Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.

Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.

Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.

Volatile Cedar has performed vulnerability scans of the target server.

APT28 has performed large-scale scans in an attempt to find vulnerable servers.

Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.

VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.

ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.