Bumblebee has been downloaded to victim's machines from OneDrive.


Chimera has used Google Cloud's appspot service to host C2 servers.


Doki has used the dogechain.info API to generate a C2 address.


During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.


EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.


Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.


FIN6 has used Pastebin and Google Storage to host content for their operations.


FIN8 has used "sslip.io", a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.


Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.


Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.


LazyScripter has used GitHub to host its payloads to operate spam campaigns.


Mustang Panda has used DropBox URLs to deliver variants of PlugX.


NETWIRE has used web services including Paste.ee to host payloads.


SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.


SharpStage has used a legitimate web service for evading detection.


TeamTNT has leveraged iplogger.org to send collected data back to C2.


Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.


WhisperGate can download additional payloads hosted on a Discord channel.


Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.


BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.


CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.


Javali can read C2 information from Google Documents and YouTube.


Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.


PlugX uses Pastebin to store C2 addresses.


PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.


RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.


RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.


Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.


Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.


A Turla JavaScript backdoor has used Google Apps Script as its C2 server.


APT12 has used blogs and WordPress for C2 infrastructure.


APT29 has used social media platforms to hide communications to C2 servers.


APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.


BLUELIGHT can use different cloud providers for its C2.


BoxCaon has used DropBox for C2 communications.


Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.


ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.


Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.


Crutch can use Dropbox to receive commands and upload stolen data.


DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.


Empire can use Dropbox and GitHub for C2.


FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.


Grandoreiro can utilize web services including Google sites to send and receive C2 data.


HEXANE has used cloud services, including OneDrive, for C2.


KARAE can use public cloud-based storage providers for command and control.


Kazuar has used compromised WordPress blogs as C2 servers.


LOWBALL uses the Dropbox cloud storage service for command and control.


Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.


MuddyWater has used web services including OneHub to distribute remote access tools.


One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.


Orz has used Technet and Pastebin web pages for command and control.


POORAIM has used AOL Instant Messenger for C2.


RogueRobin has used Google Drive as a Command and Control channel.


SLOWDRIFT uses cloud based services for C2.


Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.


The CALENDAR malware communicates through the use of events in Google Calendar.


UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.


ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.


yty communicates to the C2 server by retrieving a Google Doc.


EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.


Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.


Metamorfo has downloaded a zip file for execution on the system.


The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.


APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.


BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.


BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.


Lazarus Group has used multi-stage malware components that inject later stages into separate processes.


MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.


The Bazar loader is used to download and execute the Bazar backdoor.


Valak can download additional modules and malware capable of using separate C2 channels.


APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access.


APT33 has downloaded additional files and programs from its C2 server.


APT34 can download remote files onto victims.


APT37 has downloaded second stage malware from compromised websites.


APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.


APT39 has downloaded tools to compromised hosts.


Action RAT has the ability to download additional payloads onto an infected machine.


Agent.btz attempts to download an encrypted binary from a specified domain.


Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.


Andariel has downloaded additional tools and malware onto compromised hosts.


Aria-body has the ability to download additional payloads from C2.


Astaroth uses certutil and BITSAdmin to download additional malware.


Attor can download additional plugins, updates and other files.


AuditCred can download files and additional malware.


BADFLICK has download files from its C2 server.


BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.


BBK has the ability to download files from C2 to the infected host.


BISCUIT has a command to download a file from the C2 server.


BITSAdmin can be used to create BITS Jobs to upload and/or download files.


BITTER has downloaded additional malware and tools onto a compromised host.


BLINDINGCAN has downloaded files to a victim machine.


BLUELIGHT can download additional files onto the host.


BONDUPDATER can download or upload files from its C2 server.


BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).


Backdoor.Oldrea can download additional modules from C2.


BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.


BadPatch can download and execute or update malware.


Bankshot uploads files and secondary payloads to the victim's machine.


Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.


BendyBear is designed to download an implant from a C2 server.


Bisonal has the capability to download files to execute on the victim’s machine.


BlackMould has the ability to download files to the victim's machine.


BoomBox has the ability to download next stage malware components to a compromised system.


Briba downloads files onto infected hosts.


Bumblebee can download and execute additional payloads including through the use of a `Dex` command.


CARROTBALL has the ability to download and install a remote payload.


CHOPSTICK is capable of performing remote file transmission.


CORESHELL downloads another dropper from its C2 server.


CSPY Downloader can download additional tools to a compromised host.


Calisto has the capability to upload and download files to the victim's machine.


CallMe has the capability to download a file to the victim from the C2 server.


Cannon can download a payload for execution.


Carberp can download and execute new plugins from the C2 server.


Caterpillar WebShell has a module to download and upload files to the system.


ChChes is capable of downloading files, including additional modules.


Chaes can download additional files onto an infected machine.


Chimera has remotely copied tools and malware onto targeted systems.


China Chopper's server component can download remote files.


Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.


Conficker downloads an HTTP server to the infected machine.


Confucius has downloaded additional files and payloads onto a compromised host following initial access.


CookieMiner can download additional scripts from a web server.


CostaBricks can download additional payloads onto a compromised host.


CostaBricks has been used to load SombRAT onto a compromised host.


CreepyDrive can download files to the compromised host.


Cryptoistic has the ability to send and receive files.


Cuba can download files from its C2 server.


Cyclops Blink has the ability to download files to target systems.


DDKONG downloads and uploads files on the victim’s machine.


DOGCALL can download and execute additional payloads.


Dacls can download its payload from a C2 server.


DanBot can download additional files to a targeted system.


DarkComet can load any files onto the infected machine to execute.


Darkhotel has used first-stage payloads that download additional malware from C2 servers.


Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.


DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.


Donut can download and execute previously staged shellcode payloads.


Dragonfly downloaded tools from a remote server after they were inside the victim network.


Dragonfly has copied and installed tools for operations once in the victim environment.


DropBook can download and execute additional files.


Drovorub can download files to a compromised host.


Dtrack’s can download and upload a file to the victim’s computer.


During C0015, the threat actors downloaded additional tools and files onto a compromised network.


During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.


During Frankenstein, the threat actors downloaded files and tools onto a victim machine.


During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.


Dyre has a command to download and executes additional files.


Egregor has the ability to download files from its C2 server.


Ember Bear has used tools to download malicious code.


Emissary has the capability to download files from the C2 server.


Empire can upload and download to and from a victim machine.


EvilBunny has downloaded additional Lua scripts from the C2.


Evilnum can deploy additional components or tools as needed.


Exaramel for Linux has a command to download a file from  and to a remote C2 server.


Exaramel has a command to download a file from a remote server to execute.


Explosive has a function to download a file to the infected system.


FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.


FIN8 has used remote code execution to download subsequent payloads.


FYAnti can download additional payloads to a compromised host.


Felismus can download files from remote servers.


Flagpro can download additional malware from the C2 server.


Frankenstein has uploaded and downloaded files to utilize additional plugins.


FunnyDream can download additional files onto a compromised host.


GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.


Gamaredon Group has downloaded additional malware and tools onto a compromised host.


Gazer can execute a task to download a file.


Gelsemium can download additional plug-ins to a compromised host.


Gold Dragon can download additional components from the C2 server.


GoldMax can download and execute additional files.


GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.


Gorgon Group malware can download additional files from C2 servers.


Grandoreiro can download its second stage from a hardcoded URL within the loader's code.


GreyEnergy can download additional modules and payloads.


GrimAgent has the ability to download and execute additional payloads.


GuLoader can download further malware for execution on the victim's machine.


H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.


HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.


HAWKBALL has downloaded additional files from the C2.


HTTPBrowser is capable of writing a file to the compromised system from the C2 server.


Hancitor has the ability to download additional files from C2.


HiddenWasp downloads a tar compressed archive from a download server to the system.


Hikit has the ability to download files to a compromised host.


Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.


HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.


Hydraq creates a backdoor through which remote attackers can download files and additional malware components.


HyperBro has the ability to download additional files.


IcedID has the ability to download additional modules and a configuration file from C2.


IndigoZebra has downloaded additional files and tools from its C2 server.


Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.


InvisiMole can upload files to the victim's machine for operations.


Ixeshe can download and execute additional files.


JPIN can download files and upgrade itself.


Javali can download payloads from remote C2 servers.


KEYMARBLE can upload files to the victim’s machine and can download additional payloads.


KOCTOPUS has executed a PowerShell command to download a file to the system.


KONNI can download files and execute them on the victim’s machine.


Kasidet has the ability to download and execute additional files.


Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.


Ke3chang has used tools to download files to compromised machines.


Kessel can download additional modules from the C2 server.


Kevin can download files to the compromised host.


KeyBoy has a download and upload functionality.


Kinsing has downloaded additional lateral movement scripts from C2.


Kwampirs downloads additional files from C2 servers.


LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.


Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.


LazyScripter had downloaded additional tools to a compromised host.


Leviathan has downloaded additional scripts and files from adversary-controlled servers.


LitePower has the ability to download payloads containing system commands to a compromised host.


LoudMiner used SCP to update the miner from the C2.


Lucifer can download and execute a replica of itself using certutil.


MCMD can upload additional files to a compromised host.


MacMa has downloaded additional files, including an exploit for used privilege escalation.


Machete can download additional files for execution on the victim’s machine.


MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.


MechaFlounder has the ability to upload and download files to and from a compromised host.


Melcoz has the ability to download additional files to a compromised host.


Metamorfo has used MSI files to download additional files to execute.


Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.


MiniDuke can download additional encrypted backdoors onto the victim via GIF files.


Mis-Type has downloaded additional malware and files onto a compromised host.


Misdat is capable of downloading files from the C2.


Mivast has the capability to download and execute .exe files.


MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.


MoleNet can download additional payloads from the C2.


Molerats used executables to download malicious files from different sources.


Mongall can download files to targeted systems.


More_eggs can download and launch additional payloads.


Moses Staff has downloaded and installed web shells to following path "C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx".


Mosquito can upload and download files to the victim.


MuddyWater has used malware that can upload additional files to the victim’s machine.


Mustang Panda has downloaded additional executables following the initial infection stage.


NDiskMonitor can download and execute a file from given URL.


NETWIRE can downloaded payloads from C2 to the compromised host.


NOKKI has downloaded a remote module for execution.


NanoCore has the capability to download and activate additional modules for execution.


Neoichor can download additional files onto a compromised host.


Nomadic Octopus has used malicious macros to download additional files to the victim's machine.


OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the "curl -fsL "$url" >$tmp_path" command to download malicious payloads into a temporary directory.


OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.


OilRig can download remote files onto victims.


Operation Wocao can download additional files to the infected system.


Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.


OutSteel can download files from its C2 server.


P.A.S. Webshell can upload and download files to and from compromised hosts.


P8RAT can download additional payloads to a target system.


PLAINTEE has downloaded and executed additional plugins.


PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.


POSHSPY downloads and executes additional PowerShell code and Windows binaries.


POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.


POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.


POWRUNER can download or upload files from its C2 server.


Pasam creates a backdoor through which remote attackers can upload files.


Penquin can execute the command code "do_download" to retrieve remote files from C2.


Peppy can download and execute remote files.


PipeMon can install additional modules via C2 commands.


Pisloader has a command to upload a file to the victim machine.


PlugX has a module to download and execute files on the compromised machine.


PoisonIvy creates a backdoor through which remote attackers can upload files.


PolyglotDuke can retrieve payloads from the C2 server.


Pony can download additional files onto the infected system.


PowerDuke has a command to download a file.


PowerLess can download additional payloads to a compromised host.


PowerPunch can download payloads from adversary infrastructure.


Psylo has a command to download a file to the system from its C2 server.


Pupy can upload and download to/from a victim machine.


QakBot has the ability to download additional components and malware.


QuietSieve can download and execute payloads on a target host.


RATANKBA uploads and downloads information.


RCSession has the ability to drop additional files to an infected machine.


REvil can download a copy of itself from an attacker controlled IP address to the victim machine.


RGDoor uploads and downloads files to and from the victim’s machine.


ROKRAT can retrieve additional malicious payloads from its C2 server.


RainyDay can download files to a compromised host.


Rancor has downloaded additional malware, including by using certutil.


RedLeaves is capable of downloading a file from a specified URL.


Remcos can upload and download files to and from the victim’s machine.


RemoteUtilities can upload and download files to and from a target machine.


Revenge RAT has the ability to upload and download files.


RogueRobin can save a new file to the system from the C2 server.


S-Type can download additional files onto a compromised host.


SDBbot has the ability to download a DLL from C2 to a compromised host.


SHUTTERSPEED can download and execute an arbitary executable.


SILENTTRINITY can load additional files and tools, including Mimikatz.


SLOTHFULMEDIA has downloaded files onto a victim machine.


SLOWDRIFT downloads additional payloads.


SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites.


SUNBURST delivered different payloads, including TEARDROP in at least one instance.


Saint Bot can download additional files onto a compromised host.


Sakula has the capability to download files.


SeaDuke is capable of uploading and downloading files.


Seasalt has a command to download additional files.


ServHelper may download additional files to execute.


Seth-Locker has the ability to download and execute files on a compromised host.


Shamoon can download an executable to run on the victim.


Shark  can download additional files from its C2 via HTTP or DNS.


SharpStage has the ability to download and execute additional payloads via a DropBox API.


Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader.


ShimRatReporter had the ability to download additional payloads.


Sibot can download and execute a payload onto a compromised system.


SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.


SideTwist has the ability to download additional files.


Sidewinder has used LNK files to download remote files to the victim's network.


Silence has downloaded additional modules and malware to victim’s machines.


Skidmap has the ability to download files on an infected host.


Sliver can upload files from the C2 server to the victim machine using the "upload" command.


Small Sieve has the ability to download files.


SodaMaster has the ability to download additional payloads from C2 to the targeted system.


SpeakUp downloads and executes additional files from a remote server.


SpicyOmelette can download malicious files from threat actor controlled AWS URL's.


Squirrelwaffle has downloaded and executed additional encoded payloads.


StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.


StrifeWater can download updates and auxiliary modules.


StrongPity can download files to specified targets.


SysUpdate has the ability to download files to a compromised host.


TA505 has downloaded additional malware to execute on victim systems.


TA551 has retrieved DLLs and installer binaries for malware execution from C2.


TAINTEDSCRIBE can download additional modules from its C2 server.


TSCookie has the ability to upload and download files to and from the infected host.


TURNEDUP is capable of downloading additional files.


TYPEFRAME can upload and download files to the victim’s machine.


Taidoor has downloaded additional files onto a compromised host.


TeamTNT has the "curl" and "wget" commands as well as batch scripts to download new tools.


The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.


The Winnti for Windows dropper can place malicious payloads on targeted systems.


ThiefQuest can download and execute payloads in-memory or from disk.


Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .


ThreatNeedle can download additional tools to enable lateral movement.


TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.


Tomiris can download files and execute them on a victim's system.


Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.


TrickBot downloads several additional files and saves them to the victim's machine.


Trojan.Karagany can upload, download, and execute files on the victim.


Tropic Trooper has used a delivered trojan to download additional files.


UBoatRAT can upload and download files to the victim’s machine.


Unknown Logger is capable of downloading remote files.


Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.


VBShower has the ability to download VBS files to the target computer.


VERMIN can download and upload files to the victim's machine.


Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.


Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and Ursnif.


Volatile Cedar can deploy additional tools.


Volgmer can download remote files and additional payloads to the victim's machine.


WIRTE has downloaded PowerShell code from the C2 server to be executed.


WarzoneRAT can download and execute additional files.


Waterbear can receive and load executables from remote C2 servers.


WellMail can receive data and executable scripts from C2.


Whitefly has the ability to download additional tools from the C2.


Windshift has used tools to deploy additional payloads to compromised hosts.


Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.


XCSSET downloads browser specific AppleScript modules using a constructed URL with the "curl" command, "https://" & domain & "/agent/scripts/" & moduleName & ".applescript".


XTunnel is capable of downloading additional files.


YAHOYAH uses HTTP GET requests to download other files that are executed in memory.


ZeroT can download additional payloads onto the victim.


ZxShell has a command to transfer files from a remote host.


ZxxZ can download and execute additional files.


build_downer has the ability to download files from C2 to the infected host.


can download and execute a second-stage payload.


cmd can be used to copy files to/from a remotely connected external system.


creates a backdoor through which remote attackers can upload files.


esentutl can be used to copy files from a given URL.


ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.


gh0st RAT can download files to the victim’s machine.


menuPass has installed updates and new malware on victims.


njRAT can download files to the victim’s machine.


xCaon has a command to download files to the victim's machine.


APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.


APT38 has used the Windows API to execute code within a victim's system.


Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.


AppleSeed has the ability to use multiple dynamically resolved API calls.


Aria-body has the ability to launch files using "ShellExecute".


Attor's dispatcher has used CreateProcessW API for execution.


Avaddon has used the Windows Crypto API to generate an AES key.


BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.


BBK has the ability to use the "CreatePipe" API to add a sub-process for execution via cmd.


Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.


BackConfig can leverage API functions such as "ShellExecuteA" and "HttpOpenRequestA" in the process of downloading and executing files.


Bandook has used the ShellExecuteW() function call.


Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().


Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.


BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including "RegEnumKeyW".


BlackTech has used built-in API functions.


BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.


BoxCaon has used Windows API calls to obtain information about the compromised host.


CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.


Chaes used the "CreateFileW()" API function with read permissions to access downloaded payloads.


Chimera has used direct Windows system calls by leveraging Dumpert.


Chrommme can use Windows API including `WinExec` for execution.


Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().


Cobalt Strike's "beacon" payload is capable of running shell commands without "cmd.exe" and PowerShell commands without "powershell.exe"


ComRAT can load a PE file from memory or the file system and execute it with "CreateProcessW".


Conti has used API calls during execution.


Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.


Denis used the "IsDebuggerPresent", "OutputDebugString", and "SetLastError" APIs to avoid debugging. Denis used "GetProcAddress" and "LoadLibrary" to dynamically resolve APIs. Denis also used the "Wow64SetThreadContext" API as part of a process hollowing process.


Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.


Donut code modules use various API functions to load and inject code.


Dridex has used the "OutputDebugStringW" function to avoid malware analysis as part of its anti-debugging technique.


During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.


During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.


Egregor has used the Windows API to make detection more difficult.


Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.


EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.


Explosive has a function to call the OpenClipboard wrapper.


Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.


FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.


FunnyDream can use Native API for defense evasion, discovery, and collection.


Gamaredon Group malware has used "CreateProcess" to launch additional malicious components.


Gelsemium has the ability to use various Windows API functions to perform tasks.


GoldenSpy can execute remote commands in the Windows command shell using the "WinExec()" API.


Goopy has the ability to  enumerate the infected system's user name via "GetUserNameW".


Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.


Grandoreiro can execute through the "WinExec" API.


GrimAgent can use Native API including "GetProcAddress" and "ShellExecuteW".


GuLoader can use a number of different APIs for discovery and execution.


HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.


Hancitor has used "CallWindowProc" and "EnumResourceTypesA" to interpret and execute shellcode.


HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.


Higaisa has called various native OS APIs.


HotCroissant can perform dynamic DLL importing and API lookups using "LoadLibrary" and "GetProcAddress" on obfuscated strings.


HyperBro has the ability to run an application ("CreateProcessW") or script/file ("ShellExecuteW") via API.


HyperStack can use Windows API's "ConnectNamedPipe" and "WNetAddConnection2" to detect incoming connections and connect to remote shares.


IcedID has called "ZwWriteVirtualMemory", "ZwProtectVirtualMemory", "ZwQueueApcThread", and "NtResumeThread" to inject itself into a remote process.


InvisiMole can use winapiexec tool for indirect execution of  "ShellExecuteW" and "CreateProcessA".


KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.


KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.


Lazarus Group has used the Windows API "ObtainUserAgentString" to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.


LightNeuron is capable of starting a process using CreateProcess.


Lizar has used various Windows API functions on a victim's machine.


MacMa has used macOS API functions to perform tasks.


MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.


Milan can use the API `DnsQuery_A` for DNS resolution.


Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.


NETWIRE can use Native API including "CreateProcess" "GetProcessById", and "WriteProcessMemory".


Nebulae has the ability to use "CreateProcess" to execute a process.


Netwalker can use Windows API functions to inject the ransomware DLL.


PLEAD can use `ShellExecute` to execute applications.


PcShare has used a variety of Windows API functions.


Pillowmint has used multiple native Windows APIs to execute and conduct process injections.


PipeMon's first stage has been executed by a call to "CreateProcess" with the decryption password in an argument. PipeMon has used a call to "LoadLibrary" to load its installer.


PolyglotDuke can use "LoadLibraryW" and "CreateProcess" to load and execute code.


QakBot can use "GetProcAddress" to help delete malicious strings from memory.


RCSession can use WinSock API for communication including "WSASend" and "WSARecv".


REvil can use Native API for execution and to retrieve active services.


ROKRAT can use a variety of API calls to execute shellcode.


Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.


SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.


SUNSPOT used Windows API functions such as "MoveFileEx" and "NtQueryInformationProcess" as part of the SUNBURST injection process.


Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().


ShimRat has used Windows API functions to install the service and shim.


ShimRatReporter used several Windows API functions to gather information from the infected system.


SideCopy has executed malware by calling the API function `CreateProcessW`.


SideTwist can use "GetUserNameW", "GetComputerNameW", and "GetComputerNameExW" to gather information.


Siloscape makes various native API calls.


SodaMaster can use "RegOpenKeyW" to access the Registry.


SombRAT has the ability to respawn itself using "ShellExecuteW" and "CreateProcessW".


Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.


SynAck parses the export tables of system DLLs to locate and call various Windows API functions.


The file collection tool used by RainyDay can utilize native API including "ReadDirectoryChangeW" for folder monitoring.


ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.


Torisma has used various Windows API calls.


Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.


Ursnif has used "CreateProcessW" to create child processes.


Volgmer executes payloads using the Windows API call CreateProcessW().


WarzoneRAT can use a variety of API calls on a compromised host.


WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.


Waterbear can leverage API functions for execution.


WhisperGate has used the `ExitWindowsEx` API to flush file buffers to disk and stop running processes.


WindTail can invoke Apple APIs "contentsOfDirectoryAtPath", "pathExtension", and (string) "compare".


Winnti for Windows can use Native API to create a new process and to start services.


ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.


build_downer has the ability to use the "WinExec" API to execute malware on a compromised host.


menuPass has used native APIs including "GetModuleFileName", "lstrcat", "CreateFile", and "ReadFile".


xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.


APT34 has used brute force techniques to obtain credentials.


APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.


APT39 has used Ncrack to reveal credentials.


Caterpillar WebShell has a module to perform brute force attacks on a system.


Chaos conducts brute force attacks against SSH services to gain initial access.


Dragonfly dropped and executed Hydra, a password cracker.


FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.


Fox Kitten has brute forced RDP credentials.


HEXANE has used brute force attacks to compromise valid credentials.


Kinsing has attempted to brute force hosts over SSH.


Lazarus Group has performed brute force attacks against administrator accounts.


OilRig has used brute force techniques to obtain credentials.


Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.


QakBot can conduct brute force attacks to capture credentials.


APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.


China Chopper's server component can perform brute force password guessing against authentication portals.


CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.


Emotet has been observed using a hard coded list of passwords to brute force user accounts.


HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.


Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords.


P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.


Pony has used a small dictionary of common passwords against a collected list of local accounts.


SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.


Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.


APT3 has been known to brute force password hashes to be able to leverage plain text credentials.


APT41 performed password brute-force attacks on the local admin account.


Dragonfly 2.0 dropped and executed tools used for password cracking, including Hydra and CrackMapExec.


Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.


During Night Dragon, threat actors used Cain & Abel to crack password hashes.


FIN6 has extracted password hashes from ntds.dit to crack offline.


Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.


APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.


APT29 has conducted brute force password spray attacks.


APT33 has used password spraying to gain access to target systems.


Bad Rabbit’s "infpub.dat" file uses NTLM login credentials to brute force Windows machines.


Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.


CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.


HEXANE has used password spraying attacks to obtain valid credentials.


Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.


Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.


Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.


Sandworm Team has used a script to attempt RPC authentication against a number of hosts.


Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.


Chimera has used credential stuffing against victim's remote services to obtain valid accounts.


TrickBot uses brute-force attack against RDP with rdpscanDll module.


Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.


LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.


Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens.


Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.


A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.


ADVSTORESHELL is capable of setting and deleting Registry values.


APT19 uses a Port 22 malware variant to modify several Registry keys.


APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.


Agent Tesla can achieve persistence by modifying Registry key entries.


Amadey has overwritten registry keys for persistence.


Attor's dispatcher can modify the Run registry key.


BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.


BADCALL modifies the firewall Registry key "SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List".


Bankshot writes data into the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj".


BitPaymer can set values in the Registry to help in execution.


Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.


CSPY Downloader can write to the Registry under the "%windir%" variable to execute tasks.


Cardinal RAT sets "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load" to point to its executable.


Caterpillar WebShell has a command to modify a Registry key.


CharmPower can remove persistence-related artifacts from the Registry.


Clambling can set and delete Registry keys.


Clop can make modifications to Registry keys.


ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key.


Conficker adds keys to the Registry at "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services" and various other Registry locations.


CrackMapExec can create a registry key using wdigest.


Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.


DCSrv has created Registry keys for persistence.


During Operation Honeybee, the threat actors used batch files that modified registry keys.


EVILNUM can make modifications to the Regsitry for persistence.


Earth Lusca modified the registry using the command "reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]”" for persistence.


Ember Bear has used an open source batch script to modify Windows Defender registry keys.


Exaramel for Windows adds the configuration to the Registry in XML format.


Explosive has a function to write itself to Registry values.


FELIXROOT deletes the Registry key "HKCU\Software\Classes\Applications\rundll32.exe\shell\open".


Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.


Gelsemium has the ability to store its components in the Registry.


Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under "HKCU\Software\Microsoft\Office\".


Grandoreiro can store its configuration in the Registry at "HKCU\Software\" under frequently changing names including "%USERNAME%" and "ToolTech-RM".


GreyEnergy modifies conditions in the Registry and adds keys.


HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.


HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.


Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.


Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.


HyperStack can add the name of its communication pipe to "HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes".


InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.


KEYMARBLE has a command to create Registry entries for storing data under "HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath".


KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.


Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.


LoJax has modified the Registry key "‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’" from "‘autocheck autochk *’" to "‘autocheck autoche *’".


Magic Hound has modified Registry settings for security tools.


MegaCortex has added entries to the Registry for ransom contact information.


Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.


Mosquito stores configuration values under the Registry key "HKCU\Software\Microsoft\[dllname]" and modifies Registry keys under "HKCR\CLSID\...\InprocServer32"with a path to the launcher.


NETWIRE stores its configuration file within the Registry.


NanoCore has the capability to edit the Registry.


Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.


Nerex creates a Registry subkey that registers a new service.


Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy" to 1.


Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.


PHOREAL is capable of manipulating the Registry.


PLAINTEE uses "reg add" to add a Registry Run key for persistence.


Pillowmint has stored its malicious payload in the registry key "HKLM\SOFTWARE\Microsoft\DRM".


PipeMon has stored its encrypted payload in the Registry.


PlugX has a module to create, delete, or modify Registry keys.


PoetRAT has made registry modifications to alter its behavior upon execution.


PoisonIvy creates a Registry subkey that registers a new system device.


PolyglotDuke can write encrypted JSON configuration files to the Registry.


PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.


QuasarRAT has a command to edit the Registry on the victim’s machine.


REvil can save encryption parameters and system information to the Registry.


ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.


Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.


RegDuke can store its encryption key in the Registry.


Regin appears to have functionality to modify remote Registry information.


Remcos has full control of the Registry, including the ability to modify it.


Rover has functionality to remove Registry Run key persistence as a cleanup procedure.


SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).


SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.


SOUNDBITE is capable of modifying the Registry.


SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their "HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start" registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.


ShimRat has registered two registry keys for shim databases.


Sibot has installed a second-stage script in the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot" registry key.


Silence can create, delete, or modify a specified Registry key or value.


SysUpdate can write its configuration file to "Software\Classes\scConfig" in either "HKEY_LOCAL_MACHINE" or "HKEY_CURRENT_USER".


TA505 has used malware to disable Windows Defender through modification of the Registry.


TYPEFRAME can install encrypted configuration data under the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll" and "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs".


Taidoor has the ability to modify the Registry on compromised hosts using "RegDeleteValueA" and "RegCreateKeyExA".


TajMahal can set the "KeepPrintedJobs" attribute for configured printers in "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers" to enable document stealing.


Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.


ThreatNeedle can save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.


TinyTurla can set its configuration parameters in the Registry.


Turla has used the Registry to store encrypted payloads.


Valak has the ability to modify the Registry key "HKCU\Software\ApplicationContainer\Appsw64" to store information regarding the C2 server and downloads.


Volgmer stores the encoded configuration file in the Registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security".


WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.


WastedLocker can modify registry values within the "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" registry key.


Waterbear has deleted certain values from the Registry to load a malicious DLL.


Wizard Spider has modified the Registry key "HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest" by setting the "UseLogonCredential" registry value to "1" in order to force credentials to be stored in clear text in memory.


Zeus Panda modifies several Registry keys under "HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\" to disable phishing filters.


creates a Registry subkey that registers a new system device.


njRAT can create, delete, or modify a specified Registry key or value.


A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.


A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.


APT28 has used tools to take screenshots from victims.


APT34 has a tool called CANDYKING to capture a screenshot of user's desktop.


APT39 has used a screen capture utility to take screenshots on a compromised host.


Agent Tesla can capture screenshots of the victim’s desktop.


AppleSeed can take screenshots on a compromised host by calling a series of APIs.


Aria-body has the ability to capture screenshots on compromised hosts.


Attor's has a plugin that captures screenshots of the target applications.


Azorult can capture screenshots of the victim’s machines.


BADNEWS has a command to take a screenshot and send it to the C2 server.


BISCUIT has a command to periodically take screenshots of the system.


BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.


BRONZE BUTLER has used a tool to capture screenshots.


BadPatch captures screenshots in .jpg format and then exfiltrates them.


Bandook is capable of taking an image of and uploading the current desktop.


BlackEnergy is capable of taking screenshots.


Cadelspy has the ability to capture screenshots and webcam photos.


Cannon can take a screenshot of the desktop.


Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.


Catchamas captures screenshots based on specific keywords in the window’s title.


Chaes can capture screenshots of the infected machine.


Chrommme has the ability to capture screenshots.


Clambling has the ability to capture screenshots.


Cobalt Strike's "beacon" payload is capable of capturing screenshots.


Cobalt Strike's Beacon payload is capable of capturing screenshots.


ConnectWise can take screenshots on remote hosts.


CosmicDuke takes periodic screenshots and exfiltrates them.


Crimson contains a command to perform screen captures.


CrossRAT is capable of taking screen captures.


DOGCALL is capable of capturing screenshots of the victim's machine.


Dark Caracal took screenshots using their Windows malware.


Derusbi is capable of performing screen captures.


Dragonfly 2.0 has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).


Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).


Dragonfly has performed screen captures of victims.


DustySky captures PNG screenshots of the main screen.


Empire is capable of capturing screenshots on Windows and macOS systems.


EvilGrab has the capability to capture screenshots.


FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.


FruitFly takes screenshots of the user's desktop.


GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.


HALFBAKED can obtain screenshots from the victim.


HotCroissant has the ability to do real time screen viewing on an infected host.


Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.


HyperBro has the ability to take screenshots.


InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.


Janicab captured screenshots and sent them out to a C2 server.


KONNI can take screenshots of the victim’s machine.


Kasidet has the ability to initiate keylogging and screen captures.


Kivars has the ability to capture screenshots on the infected host.


LitePower can take system screenshots and save them to `%AppData%`.


Lizar can take JPEG screenshots of an infected system.


MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.


MacSpy can capture screenshots of the desktop over multiple monitors.


Malware used by Group5 is capable of watching the victim's screen.


Matryoshka is capable of performing screen captures.


Metamorfo can collect screenshots of the victim’s machine.


Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.


MuddyWater has used malware that can capture screenshots of the victim’s machine.


NETWIRE can capture the victim's screen.


ObliqueRAT can capture a screenshot of the current screen.


OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.


POWRUNER can capture a screenshot from a victim.


PcShare can take screen shots of a compromised machine.


Peppy can take screenshots on targeted systems.


PoetRAT has the ability to take screen captures.


Prikormka contains a module that captures screenshots of the victim's desktop.


Proton captures the content of the desktop with the screencapture binary.


Pteranodon can capture screenshots at a configurable interval.


Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.


QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.


RCSession can capture screenshots from a compromised host.


RDAT can take a screenshot on the infected system.


ROKRAT can capture screenshots of the infected system using the `gdi32` library.


Remexi takes screenshots of windows of interest.


RemoteUtilities can take screenshots on a compromised host.


RogueRobin has a command named "$screenshot" that may be responsible for taking screenshots of the victim machine.


Rover takes screenshots of the compromised system's desktop and saves them to "C:\system\screenshot.bmp" for exfiltration every 60 minutes.


SILENTTRINITY can take a screenshot of the current desktop.


SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.


SMOKEDHAM can capture screenshots of the victim’s desktop.


SharpStage has the ability to capture the victim's screen.


Silence can capture victim screen activity.


Sliver can take screenshots of the victim’s active display.


SysUpdate has the ability to capture screenshots.


T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.


TURNEDUP is capable of taking screenshots.


TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.


The FunnyDream ScreenCap component can take screenshots on a compromised host.


TinyZBot contains screen capture functionality.


Trojan.Karagany can take a desktop screenshot and save the file into "\ProgramData\Mail\MailAg\shot.png".


Turian has the ability to take screenshots.


Ursnif has used hooked APIs to take screenshots.


VERMIN can perform screen captures of the victim’s machine.


Valak has the ability to take screenshots on a compromised host.


XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.


XCSSET saves a screen capture of the victim's system with a numbered filename and ".jpg" extension. Screen captures are taken at specified intervals based on the system.


ZLib has the ability to obtain screenshots of the compromised system.


jRAT has the capability to take screenshots of the victim’s machine.


njRAT can capture screenshots of the victim’s machines.


yty collects screenshots of the victim machine.


Magic Hound has compromised email credentials in order to steal sensitive data.


Silent Librarian has exfiltrated entire mailboxes from compromised accounts.


APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.


Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.


Chimera has harvested data from victim's e-mail including through execution of "wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy".


CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.


Crimson contains a command to collect and exfiltrate emails from Outlook.


Emotet has been observed leveraging a module that scrapes email data from Outlook.


Empire has the ability to collect emails on a target system.


Magic Hound has collected .PST archives.


Pupy can interact with a victim’s Outlook session and look through folders and emails.


QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.


Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).


APT28 has collected emails from victim Microsoft Exchange servers.


APT29 collected emails from specific individuals, such as executives and IT staff, using "New-MailboxExportRequest" followed by "Get-MailboxExportRequest".


Chimera has harvested data from remote mailboxes including through execution of "\\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost".


Dragonfly 2.0 accessed email accounts using Outlook Web Access.


FIN4 has accessed and hijacked online email communications using stolen credentials.


HAFNIUM has used web shells to export mailbox data.


Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.


Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.


Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.


LightNeuron collects Exchange emails matching rules specified in its configuration.


Magic Hound has exported emails from compromised Exchange servers.


MailSniper can be used for searching through email in Exchange and Office 365 environments.


UNC2452 collected emails from specific individuals, such as executives and IT staff, using "New-MailboxExportRequest" followed by "Get-MailboxExportRequest".


Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.


Kimsuky has set auto-forward rules on victim's e-mail accounts.


LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.


Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.


A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.


APT38 used a Trojan called KEYLIME to collect data from the clipboard.


APT39 has used tools capable of stealing contents of the clipboard.


Agent Tesla can steal data from the victim’s clipboard.


Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.


Cadelspy has the ability to steal data from the clipboard.


Catchamas steals data stored in the clipboard.


Clambling has the ability to capture and store clipboard data.


CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.


DarkComet can steal data from the clipboard.


Empire can harvest clipboard data on both Windows and macOS systems.


Explosive has a function to use the OpenClipboard wrapper.


KONNI had a feature to steal data from the clipboard.


Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.


Melcoz can monitor content saved to the clipboard.


Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.


Operation Wocao has collected clipboard data in plaintext.


ROKRAT can extract clipboard data from a compromised host.


Remcos steals and modifies data from the clipboard.


Remexi collects text from the clipboard.


The executable version of Helminth has a module to log clipboard contents.


TinyZBot contains functionality to collect information from the clipboard.


VERMIN collects data stored in the clipboard.


A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.


APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.


APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.


AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.


Attor has automatically collected data about the compromised system.


BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.


Bankshot recursively generates a list of files within a directory and sends them back to the control server.


Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.


During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.


During Operation Wocao, threat actors used a script to collect information about the infected system.


FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.


For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.


Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.


FunnyDream can monitor files for changes and automatically collect them.


Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.


GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.


InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.


Ke3chang has performed frequent and scheduled data collection from victim networks.


MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.


Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.


Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).


Mustang Panda used custom batch scripts to collect files automatically from a targeted system.


OutSteel can automatically scan for and collect files with specific extensions.


Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.


PoetRAT used file system monitoring to track modification and enable automatic exfiltration.


PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.


RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.


Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.


Sidewinder has used tools to automatically collect system and network configuration information.


StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.


TajMahal has the ability to index and compress files into a send queue for exfiltration.


VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .


Valak can download a module to search for and build a report of harvested credential data.


WindTail can identify and add files that possess specific file extensions to an array for archiving.


Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.


ccf32 can be used to automatically collect files from a compromised host.


ADVSTORESHELL can list connected devices.


APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.


APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.


Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.


BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.


BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.


BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.


Cadelspy has the ability to steal information about printers and the documents sent to printers.


Crimson has the ability to discover pluggable/removable drives to extract files from.


Crutch can monitor for removable drives being plugged into the compromised machine.


During Operation Wocao, threat actors discovered removable disks attached to a system.


DustySky can detect connected USB devices.


Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.


Ferocious can run "GET.WORKSPACE" in Microsoft Excel to check if a mouse is present.


FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.


Mongall can identify removable media attached to compromised hosts.


MoonWind obtains the number of removable drives from the victim.


ObliqueRAT can discover pluggable/removable drives to extract files from.


OilRig has used tools to identify if a mouse is connected to a targeted system.


Operation Wocao has discovered removable disks attached to a system.


QakBot can identify peripheral devices on targeted systems.


QuietSieve can identify and search removable drives for specific file name extensions.


RTM can obtain a list of smart card readers attached to the victim.


Ragnar Locker may attempt to connect to removable drives and mapped network drives.


Ramsay can scan for removable media which may contain documents for collection.


Stuxnet enumerates removable drives for infection.


T9000 searches through connected drives for removable storage devices.


TajMahal has the ability to identify connected Apple devices.


TeamTNT has searched for attached VGA devices using lspci.


Turla has used "fsutil fsinfo drives" to list connected drives.


USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.


USBferry can check for connected USB devices.


WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.


WastedLocker can enumerate removable drives prior to the encryption process.


XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running "ls -la ~/Library/Application\ Support/MobileSync/Backup/".


Zebrocy enumerates information about connected storage devices.


APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.


Attor's has a plugin that is capable of recording audio using available input sound devices.


Cadelspy has the ability to record audio from the compromised host.


Cobian RAT has a feature to perform voice recording on the victim’s machine.


Crimson can perform audio surveillance using microphones.


DOGCALL can capture microphone data from the victim's machine.


DarkComet can listen in to victims' conversations through the system’s microphone.


EvilGrab has the capability to capture audio from a victim machine.


Flame can record audio using any existing hardware recording devices.


InvisiMole can record sound using input audio devices.


Janicab captured audio and sent it out to a C2 server.


MacSpy can record the sounds from microphones on a computer.


Machete captures audio from the computer’s microphone.


NanoCore can capture audio feeds from the system.


Pupy can record sound with the microphone.


ROKRAT has an audio capture and eavesdropping module.


Remcos can capture data from the system’s microphone.


Revenge RAT has a plugin for microphone interception.


T9000 uses the Skype API to record audio and video calls. It writes encrypted data to "%APPDATA%\Intel\Skype".


TajMahal has the ability to capture VoiceIP application audio on an infected host.


AppleSeed can pull a timestamp from the victim's machine.


As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.


Astaroth collects the timestamp from the infected machine.


BRONZE BUTLER has used "net time" to check the local time on a target system.


BendyBear has the ability to determine local time on a compromised host.


Bisonal can check the system time set on the infected host.


Carbon uses the command "net time \\127.0.0.1" to get information the system’s time.


Chimera has used "time /t" and "net time \\ip/hostname" for system time discovery.


Clambling can determine the current time.


ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).


Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.


DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.


DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.


DarkWatchman can collect the time zone information from the system.


Darkhotel malware can obtain system time from a compromised host.


During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.


During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.


Egregor contains functionality to query the local/system time.


Epic uses the "net time" command  to get the system time from the machine and collect the current date and time zone information.


FunnyDream can check system time to help determine when changes were made to specified files.


GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.


GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.


Grandoreiro can determine the time on the victim machine via IPinfo.


GravityRAT can obtain the date and time of a system.


Green Lambert can collect the date and time from a compromised host.


HOPLIGHT has been observed collecting system time from victim machines.


Higaisa used a function to gather the current time.


Metamorfo uses JavaScript to get the system time.


NOKKI can collect the current timestamp of the victim's machine.


Okrum can obtain the date and time of the compromised system.


PipeMon can send time zone information from a compromised host to C2.


PowerDuke has commands to get the time the machine was built, the time, and the time zone.


QakBot can identify the system time on a targeted host.


SILENTTRINITY can collect start time information from a compromised host.


SombRAT can execute "getinfo"  to discover the current time on a compromised host.


StoneDrill can obtain the current date and time of the victim machine.


StrifeWater can collect the time zone from the victim's machine.


Stuxnet collects the time and date of a system when it is infected.


TAINTEDSCRIBE can execute "GetLocalTime" for time discovery.


Taidoor can use "GetLocalTime" and "GetSystemTime" to collect system time.


The White Company has checked the current date on the victim system.


Turla surveys a system upon check-in to discover the system time by using the "net time" command.


UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.


WindTail has the ability to generate the current date and time.


ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.


Zebrocy gathers the current time zone and date information from the system.


build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.


Agent Tesla can access the victim’s webcam and record video.


Bandook has modules that are capable of capturing video from a victim's webcam.


Clambling can record screen content in AVI format.


ConnectWise can record video on remote hosts.


Crimson can capture webcam video on targeted systems.


DarkComet can access the victim’s webcam to take pictures.


Empire can capture webcam data on Windows and macOS systems.


EvilGrab has the capability to capture video from a victim machine.


FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.


Imminent Monitor has a remote webcam monitoring capability.


InvisiMole can remotely activate the victim’s webcam to capture content.


NanoCore can access the victim's webcam and capture data.


ObliqueRAT can capture images from webcams on compromised hosts.


PcShare can capture camera video as part of its collection process.


PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.


Remcos can access a system’s webcam and take pictures.


SDBbot has the ability to record video on a compromised host.


TajMahal has the ability to capture webcam video.


WarzoneRAT can access the webcam on a victim's machine.


ZxShell has a command to perform video device spying.


jRAT has the capability to capture video from a webcam.


A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques.


Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.


A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.


During Frankenstein, the threat actors used MSbuild to execute an actor-created file.


Astaroth uses the LoadLibraryExW() function to load additional modules.


Attor's dispatcher can execute additional plugins by loading the respective DLLs.


BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.


BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.


Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.


Dtrack contains a function that calls "LoadLibrary" and "GetProcAddress".


FoggyWeb's loader can call the "load()" function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.


Hydraq creates a backdoor through which remote attackers can load and call DLL functions.


KillDisk loads and executes functions from a DLL.


Metamorfo had used AutoIt to load and execute the DLL payload.


PipeMon has used call to "LoadLibrary" to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.


Stuxnet calls LoadLibrary then executes exports from a DLL.


TajMahal has the ability to inject the "LoadLibrary" call template DLL into running processes.


After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.


H1N1 obfuscates C2 traffic with an altered version of base64.


Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.


Mythic provides various transform functions to encode and/or randomize C2 data.


Ursnif has used encoded data in HTTP URLs for C2.


A JHUHUGIT variant encodes C2 POST data base64.


APT33 has used base64 to encode command and control traffic.


An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.


Astaroth encodes data using Base64 before sending it to the C2 server.


AutoIt backdoor has sent a C2 response that was base64-encoded.


BS2005 uses Base64 encoding for communication in the message body of an HTTP request.


BabyShark has encoded data using certutil before exfiltration.


Bisonal has encoded binary data with Base64 and ASCII.


Bumblebee has the ability to base64 encode C2 server responses.


C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.


Carbanak encodes the message body of HTTP traffic with Base64.


ChChes can encode C2 data with a custom technique that utilizes Base64.


Chaes has used Base64 to encode C2 communications.


CharmPower can send additional modules over C2 encoded with base64.


Cobian RAT obfuscates communications with the C2 server using Base64 encoding.


CreepySnail can use Base64 to encode its C2 traffic.


DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.


Daserf uses custom base64 encoding to obfuscate HTTP traffic.


Denis encodes the data sent to the server in Base64.


DnsSystem can Base64 encode data sent to C2.


Ebury has encoded C2 traffic in hexadecimal format.


Elise exfiltrates data using cookie values that are Base64-encoded.


For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.


Fysbis can use Base64 to encode its C2 traffic.


HAFNIUM has used ASCII encoding for C2 traffic.


HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.


Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.


KONNI has used a custom base64 key to encode stolen data before exfiltration.


Kazuar encodes communications to the C2 server in Base64.


Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.


Kevin can Base32 encode chunks of output files during exfiltration.


MechaFlounder has the ability to use base16 encoded strings in C2.


Mis-Type uses Base64 encoding for C2 traffic.


Misdat network traffic is Base64-encoded plaintext.


Mongall can use Base64 to encode information sent to its C2.


More_eggs has used basE91 encoding, along with encryption, for C2 communication.


Mori can use Base64 encoded JSON libraries used in C2.


MuddyWater has used tools to encode C2 communications including Base64 encoding.


Octopus has encoded C2 communications in Base64.


Okrum has used base64 to encode C2 communication.


Patchwork used Base64 to encode C2 traffic.


PingPull can encode C2 traffic with Base64.


PowerShower has the ability to encode C2 communications with base64 encoding.


Prikormka encodes C2 traffic with Base64.


QUADAGENT encodes C2 communications with base64.


QakBot can Base64 encode system information sent to C2.


RDAT can communicate with the C2 via base32-encoded subdomains.


Ramsay has used base64 to encode its C2 traffic.


Responses from the Pisloader C2 server are base32-encoded.


RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.


SMOKEDHAM has encoded its C2 traffic with Base64.


STARWHALE has the ability to hex-encode collected data from an infected host.


Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.


Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.


SideTwist has used Base64 for encoded C2 traffic.


Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.


Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.


Some Felismus samples use a custom method for C2 traffic that utilizes Base64.


Squirrelwaffle has encoded its communications to C2 servers using Base64.


Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.


TA551 has used encoded ASCII text for initial C2 communications.


Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.


Valak has returned C2 data as encoded ASCII.


WellMess has used Base64 encoding to uniquely identify communication to and from the C2.


Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.


down_new has the ability to base64 encode C2 communications.


gh0st RAT has used Zlib to compress C2 communications data before encrypting it.


njRAT uses Base64 encoding for C2 traffic.


xCaon has used Base64 to encode its C2 traffic.


Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.


InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.


Newer variants of BACKSPACE will encode C2 communications with a custom system.


PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.


RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.


ShadowPad has encoded data as readable Latin characters.


Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.


APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.


APT29 has used compromised identities to access networks via SSH,  VPNs, and other remote access tools.


APT34 uses remote services such as VPN, Citrix, or OWA to persist in an environment.


APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.


Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.


Doki was executed through an open Docker daemon API port.


Dragonfly 2.0 used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.


Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.


Dragonfly used remote access services, including VPN and Outlook Web Access (OWA).


During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.


During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.


During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.


GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.


GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.


Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.


Kimsuky has used RDP to establish persistence.


LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.


Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.


Linux Rabbit attempts to gain access to the server via SSH.


OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.


Operation Wocao has used stolen credentials to connect to the victim's network via VPN.


Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.


TEMP.Veles has used a VPN to persist in the victim environment.


TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.


Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.


UNC2452 has used compromised identities to access VPNs and remote access tools.


AppleSeed can gain system level privilege by passing "SeDebugPrivilege" to the "AdjustTokenPrivilege" API.


Blue Mockingbird has used JuicyPotato to abuse the "SeImpersonate" token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.


Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.


Empire can use PowerSploit's "Invoke-TokenManipulation" to manipulate access tokens.


FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.


Gelsemium can use token manipulation to bypass UAC on Windows7 systems.


HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.


Hydraq creates a backdoor through which remote attackers can adjust token privileges.


PowerSploit's "Invoke-TokenManipulation" Exfiltration module can be used to manipulate tokens.


Ryuk has attempted to adjust its token privileges to have the "SeDebugPrivilege".


SUNSPOT modified its security token to grants itself debugging privileges by adding "SeDebugPrivilege".


Sliver has the ability to manipulate user tokens on targeted Windows systems.


SslMM contains a feature to manipulate process privileges and tokens.


APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.


BitPaymer can use the tokens of users to create processes on infected systems.


Cobalt Strike can steal access tokens from exiting processes.


FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.


Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.


Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.


SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.


Shamoon can impersonate tokens using "LogonUser", "ImpersonateLoggedOnUser", and "ImpersonateNamedPipeClient".


Siloscape impersonates the main thread of "CExecSvc.exe" by calling "NtImpersonateThread".


Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.


Tarrask leverages token theft to obtain `lsass.exe` security permissions.


Aria-body has the ability to execute a process using "runas".


Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.


Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.


KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.


Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call "CreateProcessAsUserA" under that user's context.


PipeMon can attempt to gain administrative privileges using token impersonation.


PoshC2 can use Invoke-RunAs to make tokens.


REvil can launch an instance of itself with administrative rights using runas.


ZxShell has a command called RunAs, which creates a new process as another user or process context.


Cobalt Strike can make tokens from known credentials.


Cobalt Strike can spawn processes with alternate PPIDs.


KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.


Empire can add a SID-History to a user if on a domain controller.


Mimikatz's "MISC::AddSid" module can appended any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.


APT32 used the "net view" command to show all shares available, including the administrative shares such as "C$" and "ADMIN$".


APT38 has enumerated network shares on a compromised host.


APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.


APT41 used the "net share" command as part of network reconnaissance.


Avaddon has enumerated shared folders and mapped volumes.


Bazar can enumerate shared drives on the domain.


Chimera has used "net share" and "net view" to identify network shares of interest.