Automated Collection

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

Chimera has used custom DLLs for continuous retrieval of data from memory.

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.

Ember Bear engages in mass collection from compromised systems during intrusions.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.

Attor has automatically collected data about the compromised system.

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.

Bankshot recursively generates a list of files within a directory and sends them back to the control server.

ccf32 can be used to automatically collect files from a compromised host.

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.

Crutch can automatically monitor removable drives in a loop and copy interesting files.

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to automatically collect and process large volumes of data from without human direction.

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.

ArcaneDoor included collection of packet capture and system configuration information.

During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.

During Operation Wocao, threat actors used a script to collect information about the infected system.

During SharePoint ToolShell Exploitation, threat actors used a command shell to automatically iterate through web.config files to expose and collect machineKey settings.