Microsoft POLONIUM June 2022

CreepyDrive can upload files to C2 from victim machines.

CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.

CreepySnail can execute `getUsername` on compromised systems.

CreepySnail can connect to C2 for data exfiltration.

CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.

CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.

CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.

CreepySnail can use HTTP for C2.

POLONIUM has used valid compromised credentials to gain access to victim environments.

CreepySnail can use stolen credentials to authenticate on target networks.

CreepyDrive can specify the local file path to upload files from.

POLONIUM has used the AirVPN service for operational activity.

CopyKittens has used the AirVPN service for operational activity.

CreepyDrive can use OneDrive for C2.

HEXANE has used cloud services, including OneDrive, for C2.

POLONIUM has used OneDrive and DropBox for C2.

CreepyDrive can download files to the compromised host.

CreepySnail can use Base64 to encode its C2 traffic.

POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.

CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.

HEXANE has used cloud services, including OneDrive, for data exfiltration.

POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.

CreepyDrive can use cloud services including OneDrive for data exfiltration.

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.

CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.