CVE-2018-4878 was the second most commonly observed vulnerability and is the only Adobe Flash Player vulnerability on this year’s top 10. Like CVE-2018-8174, this vulnerability was included in multiple exploit kits, most notably the Fallout exploit kit, which was used to distribute GandCrab ransomware. Fallout took its name and URI patterns from the now defunct Nuclear exploit kit, which had been associated with CVE-2015-7645, one of 2016’s top 10 vulnerabilities. In 2018, Fallout was last selling for $300 a week and $1,100 a month, as seen below.


In early February 2018, FireEye iSIGHT Intelligence observed Dridex botnet ID 2040 download a Monero cryptocurrency miner based on the open-source XMRig miner.. On Feb. 12, 2018, FireEye iSIGHT Intelligence observed the banking malware IcedID injecting Monero-mining JavaScript into webpages for specific, targeted URLs. The IcedID injects launched an anonymous miner using the mining code from Coinhive's AuthedMine.. In late 2017, Bleeping Computer reported that security researchers with Radware observed the hacking group CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.. In late 2017, FireEye researchers observed Trickbot operators deploy a new module named "testWormDLL" that is a statically compiled copy of the popular XMRig Monero miner.. On Aug. 29, 2017, Security Week reported on a variant of the popular Neutrino banking Trojan, including a Monero miner module. According to their reporting, the new variant no longer aims at stealing bank card data, but instead is limited to downloading and executing modules from a remote server.


Enabling the macros starts a multi-stage infection chain that eventually downloads and executes a Cobalt Strike beacon, providing the attackers with a foothold inside the target organization.


Kaspersky Lab detections for Blue, Black, and Green Lamberts have been triggered by a relatively small set of victims from around the world.  While investigating one of these infections involving White Lambert (network-driven implant) and Blue Lambert (active implant), we found yet another family of tools that appear to be related.  We called this new family ‘Pink Lambert’.


In most cases, UNC2165 has stolen data from its victims to use as leverage for extortion after it has deployed ransomware across an environment. In intrusions where the data exfiltration method could be identified, there is evidence to suggest the group used either Rclone or MEGASync to transfer data from the victims' environments prior to encryption. The Rclone utility is used by many financially motivated actors to synchronize sensitive files with cloud storage providers, and MEGASync synchronizes data to the MEGA cloud hosting service.


The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.


On March 5, 2020, researcher Steven Seeley, published an advisory and released proof-of-concept code for a zero-day remote code execution vulnerability in Zoho ManageEngine Desktop Central versions prior to 10.0.474 (CVE-2020-10189). Beginning on March 8, FireEye observed APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers, which resulted in the compromise of at least five separate customers. FireEye observed two separate variations of how the payloads (install.bat and storesyncsvc.dll) were deployed. In the first variation the CVE-2020-10189 exploit was used to directly upload “logger.zip”, a simple Java based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.


Uploads a file on the victim’s computer to the C&C server


Prior to encryption, the ransomware will check if the directory is in the root path and avoids the following files and directories


Enumerates remote open SMB network shares


Uses legitimate VPN or Citrix credentials to maintain access to an environment.


Uses tools such as PDQ Inventory scanner, Advanced Port Scanner and netscan (which also scanned for the ProxyShell vulnerability).


The group abuses common cloud services such as Dropbox, OneDrive, and Mega for C&C communications (receive commands and exfiltrate data).


Instead of more traditional malware like a Windows executable (.exe) or Dynamic Link Library (.dll), the malware authors used a browser extension as their final payload


Uses 7-Zip to compress stolen data for exfiltration.


FormatLoader’s main purpose is to infect the machine with an additional malicious file by downloading the binary to the compromised machine. To do so, the malware adds digits from the hardcoded range one by one to the hardcoded format strings, and accesses the download links.


In its new attack, the actor initiated the infection chain sending a spear-phishing email containing a macro-embedded Word document.


Even more, this tiny bootkit with a size of only 80 kb on disk after installation can disable built-in Windows security protection such as Hypervisor-Protected Code Integrity (HVCI) and Windows Defender and bypass User Account Control (UAC).


Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded.


Although Cobalt Strike has many capabilities beneficial to threat actors in ransomware attacks, it was mainly seen in LockBit 2.0 investigations acting as a command and control beacon, a method of lateral movement and a tool for downloading/executing files.


BlackMatter harvests credentials from Local Security Authority Subsystem Service (LSASS) memory using procmon.


Chinese state-sponsored cyber actors have been observed gaining access to victim networks through watering hole campaigns of typo-squatted domains.


Chinese state-sponsored cyber actors have been observed:  Using cmd.exe, JavaScript/Jscript Interpreter, and network device command line interpreters (CLI).  Using PowerShell to conduct reconnaissance, enumeration, and discovery of the victim network.  Employing Python scripts to exploit vulnerable servers.  Using a UNIX shell in order to conduct discovery, enumeration, and lateral movement on Linux® servers in the victim network.


Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands. Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used.


Chinese state-sponsored cyber actors have been observed using commands, including tasklist, jobs, ps, or taskmgr, to reveal the running processes on victim devices.


Chinese state-sponsored cyber actors used RDP and execute rdpclip.exe to exfiltrate information from the clipboard.


Chinese state-sponsored cyber actors have been observed importing tools from GitHub or infected domains to victim networks. In some instances. Chinese statesponsored cyber actors used the Server Message Block (SMB) protocol to import tools into victim networks.


Chinese state-sponsored cyber actors have been observed using tools like dog-tunnel and dns2tcp.exe to conceal C2 traffic with existing network activity.


The actors used a Powershell cmdlet (NewManagementRoleAssignment) to grant the 'ApplicationImpersonation' role to a compromised account.


The actors used the ntdsutil.exe utility, which was present on a target's Active Directory® server to export the Active Directory database for credential access.


The actors used a variety of utilities, including publicly available versions of WinRAR® , to archive collected data with password protection.


The actors used certutil.exe, a known Living Off the Land" technique, to transfer a file into a target environment."


The Iranian government-sponsored APT actors may have made modifications to the Task Scheduler. These modifications may display as unrecognized scheduled tasks or actions. Specifically, the below established tasks may be associated with this activity: SynchronizeTimeZone GoogleChangeManagement MicrosoftOutLookUpdater MicrosoftOutLookUpdateSchedule


Actors used the taskkill command to probably disable security features. CISA was unable to determine which application was associated with the Process ID.


The part of the malicious code that drops and executes a payload is nearly identical between the two samples. The legitimate Windows executable C:\Windows\System32\colorcpl.exe is copied to the new directory C:\ProgramData\PackageColor and the embedded payload is written to C:\ProgramData\PackageColor\colorui.dll.


Either via the LNK after startup, or directly via the VBS, the command line “wscript.exe //B //E:vbs C:\Users\Public\Favorites\desktop.ini” is executed, referencing the helper file dropped by the sample mentioned above. Finally, the file C:\Users\Public\ignit.vbs is deleted after execution.


“desktop.ini” is used to invoke regasm.exe to launch the payload found in C:\Users\Public\Libraries\core.dll as a hidden window without returning any error codes.


The actor's CovalentStealer tool stores collected files on a Microsoft OneDrive cloud folder.


The Chrome extension is installed and maintained by a number of plist files written to the user directory ~/Library/LaunchAgent/. To conceal the malicious behavior, the underlying commands in the plist files are obfuscated with Base64 encoding.


The first plist, ~/Library/LaunchAgents/com.safarii.extension.plist, does not use a StartInterval value like the Chrome variant, but instead uses RunAtLoad. The RunAtLoad parameter is executed when the user logs into their computer. Note that the plist file does not use the correct spelling of Safari.


An attacker runs the MimiKatz tool and launches a DCShadow attack (lsadump::dcshadow)


The Nefilim ransomware uses a batch file to stop services and kill processes in the local host. This batch file abuses taskill.exe using CMD to kill predefined services and processes in the target host. Nefilim distributes this batch file to multiple hosts using two batch files. One of the batch files uses the ‘copy’ command, and the other one uses WMI with hard-coded admin credentials.


Nefilim removes itself from the target systems after infection with the following code: del C:\Users\admin\AppData\Local\Temp\<ransomware_file_name>.exe" /s /f /q"


The Nefilim ransomware queries volume information (disk volume name and serial number) and Cryptographic Machine GUID. Ransomware families use  Cryptographic Machine GUID and volume serial number to generate a unique identifier for the host for encryption/decryption processes. Nefilim obtains Cryptographic Machine GUID by querying the value of MachineGuid in the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography


Mandiant identified a campaign where the threat actors gained access to the target organization’s Microsoft 365 environment using a stolen session token. Mandiant analyzed the workstations belonging to the end user and discovered that some systems had been infected with CRYPTBOT, an info-stealer malware, shortly before the stolen session token was generated. Mandiant observed that in some cases the user downloaded the malware after browsing to low reputation websites offering free, or “cracked”, software.


when the method R is invoked, InstallUtil.exe is spawned in suspended mode. The memory blocks of the suspended process are unmapped and rewritten with the sections of the payload program passed as an argument to method R. The thread is allowed to continue after changes have been made to the entry point.


To facilitate the staging of BEACON on remote systems APT29 utilized a malicious certificate that allowed the group to impersonate a privileged user.


It can reflectively load a DLL/EXE in to the PowerShell process, or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, please lead the Notes section (GENERAL NOTES) for information on how to use them.


Like the function name says Invoke-ReflectivePEInjection loads an portable executable (PE) file or DLL into the current or remote process memory and executes this file in memory.


Invoke-Mimikatz.ps1 is the PowerShell implementation of Mimikatz. The PowerShell script loads Mimikatz.exe reflectively into the process memory.


Files contained within image files, like mounted ISO files, will not contain the Zone.Identifier Alternate Data Stream (ADS) flag that indicates the files have been downloaded from the internet (so called “mark-of-the-web”) as reported by Didier Stevens.


We believe that the modified library file, which we’ve named LOCKPICK, could weaken encryption for communications used by the appliance, but do not have enough evidence to confirm this


In the second variation, FireEye observed APT41 leverage the Microsoft BITSAdmin command-line tool to download install.bat (MD5: 7966c2c546b71e800397a67f942858d0) from known APT41 infrastructure 66.42.98[.]220 on port 12345.


During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.


FlawedAmmyy may obfuscate portions of the initial C2 handshake.


FunnyDream can send compressed and obfuscated packets to C2.


Operation Wocao has encrypted IP addresses used for "Agent" proxy hops with RC4.


POWRUNER can use base64 encoded C2 communications.


RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.


SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.


SideTwist can embed C2 responses in the source code of a fake Flickr webpage.


The Axiom group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate.


TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.


Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.


GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.


GrimAgent  can pad C2 messages with random generated values.


Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.


P2P ZeuS added junk data to outgoing UDP packets to peer implants.


P8RAT can send randomly-generated data as part of its C2 communication.


SUNBURST added junk bytes to its C2 over HTTP.


TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.


Turian can insert pseudo-random characters into its network encryption setup.


WellMess can use junk data in the Base64 string for additional obfuscation.


APT29 has used steganography to hide C2 communications in images.


Axiom has used steganography to hide its C2 communications.


Daserf can use steganography to hide malicious code downloaded to the victim.


HAMMERTOSS is controlled via commands that are appended to image files.


LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.


RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.


Sliver can encode binary data into a .PNG file for C2 communication.


When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.


Zox has used the .PNG file format for C2 communications.


BADCALL uses a FakeTLS method during C2.


Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.


Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.


FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.


HARDRAIN uses FakeTLS to communicate with its C2 server.


KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.


Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.


Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.


SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.


TAINTEDSCRIBE has used FakeTLS for session authentication.


APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.


APT32 used GetPassword_x64 to harvest credentials.


APT39 has used different versions of Mimikatz to obtain credentials.


Carbanak obtains Windows logon password details.


Dragonfly dropped and executed SecretsDump, a tool that dumps password hashes.


Frankenstein has harvested credentials from the victim's machine using Empire.


KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.


Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.


OnionDuke steals credentials from its victims.


PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).


Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.


Revenge RAT has a plugin for credential harvesting.


Sowbug has used credential dumping tools.


Suckfly used a signed credential-dumping tool to obtain victim account credentials.


APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.


APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.


APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.


Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.


BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.


Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.


Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.


Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.


CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.


Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.


During Operation Wocao, threat actors used ProcDump to dump credentials from memory.


Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.


Emotet has been observed dropping password grabber modules including Mimikatz.


FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).


GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.


GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.


HAFNIUM has used "procdump" to dump the LSASS process memory.


Kimsuky has gathered credentials using Mimikatz and ProcDump.


LaZagne can perform credential dumping from memory to obtain account and password information.


Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.


Lizar can run Mimikatz to harvest credentials.


Magic Hound has stolen domain credentials by dumping LSASS process memory with comsvcs.dll and from a Microsoft Active Directory Domain Controller using Mimikatz.


Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.


OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.


Okrum was seen using MimikatzLite to perform credential dumping.


Operation Wocao has used ProcDump to dump credentials from memory.


PLATINUM has used keyloggers that are also capable of dumping credentials.


PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.


PoshC2 contains an implementation of Mimikatz to gather credentials from memory.


PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.


Pupy can execute Lazagne as well as Mimikatz using PowerShell.


Pysa can perform OS credential dumping using Mimikatz.


SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.


Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory.


SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.


Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.


Stolen Pencil gathers credentials using Mimikatz and Procdump.


TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials.


Whitefly has used Mimikatz to obtain credentials.


Windows Credential Editor can dump credentials.


Cobalt Strike can recover hashed passwords.


Dragonfly has dropped and executed SecretsDump to dump password hashes.


During Night Dragon, threat actors dumped account hashes using gsecdump.


During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.


Fgdump can dump Windows password hashes.


HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.


Ke3chang has dumped credentials, including by using gsecdump.


Koadic can gather hashed passwords by dumping SAM/SECURITY hive.


Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.


Mivast has the capability to gather NTLM password information.


Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.


POWERTON has the ability to dump password hashes.


Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.


Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.


gsecdump can dump Windows password hashes from the SAM.


CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.


HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).


Ke3chang has used NTDSDump and other password dumping tools to gather credentials.


Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.


LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.


Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used "reg save" on the SYSTEM file Registry location to help extract the NTDS.dit file.


SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.


Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.


esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.


menuPass has used Ntdsutil to dump credentials.


AADInternals can dump secrets from the Local Security Authority.


APT33 has used a variety of publicly available tools like LaZagne to gather credentials.


CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.


IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.


Leafminer used several tools for retrieving login and password information, including LaZagne.


MuddyWater has performed credential dumping with LaZagne.


OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.


Cachedump can extract cached password hashes from cache entry information.


LaZagne can perform credential dumping from MSCache to obtain account and password information.


Okrum was seen using modified Quarks PwDump to perform credential dumping.


APT29 leveraged privileged accounts to replicate directory service data with domain controllers.


Earth Lusca has used a "DCSync" command with Mimikatz to retrieve credentials from an exploited controller.


LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.


Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.


Operation Wocao has used Mimikatz's DCSync to dump credentials from the memory of the targeted system.


UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers.


LaZagne can obtain credential information running Linux processes.


MimiPenguin can dump process memory and extract clear-text credentials.


LaZagne can obtain credential information from /etc/shadow using the shadow.py module.


APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.


APT29 has extracted files from compromised networks.


APT3 will identify Microsoft Office documents on the victim's computer.


APT37 has collected data from victims' local systems.


APT39 has used various tools to steal files from the compromised host.


Action RAT can collect local data from an infected machine.


AppleSeed can collect data on a compromised host.


AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.


Axiom has collected data from a compromised network.


BRONZE BUTLER has exfiltrated files stolen from local systems.


BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.


Bandook can collect local files from the system .


Bankshot collects files from the local system.


Bazar can retrieve information from the infected machine.


Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.


Calisto can collect data from user directories.


Caterpillar WebShell has a module to collect information from the local database.


China Chopper's server component can upload local files.


Chrommme can collect data from a local system.


Clambling can collect information from a compromised host.


Cobalt Strike can collect data from a local system.


CookieMiner has retrieved iPhone text messages from iTunes phone backup files.


CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.


Crutch can exfiltrate files from compromised systems.


Cyclops Blink can upload files from a compromised host.


DRATzarus can collect information from a compromised host.


DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.


Dragonfly 2.0 collected data from local victim systems.


Dtrack can collect a variety of information from victim machines.


During C0015, the threat actors obtained files and data from the compromised network.


During Frankenstein, the threat actors used Empire to gather various local system information.


During Night Dragon, the threat actors collected files and other data from compromised systems.


During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.


During Operation Honeybee, the threat actors collected data from compromised hosts.


Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.


FIN7 has collected files and other sensitive information from a compromised network.


FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.


FlawedAmmyy has collected information and files from a compromised machine.


Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).


FrameworkPOS can collect elements related to credit card data from process memory.


Frankenstein has enumerated hosts via Empire, gathering various local system information.


FunnyDream can upload files from victims' machines.


Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.


Goopy has the ability to exfiltrate documents from infected systems.


GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.


Green Lambert can collect data from a compromised host.


GrimAgent can collect data and files from a compromised host.


IceApple can collect files, passwords, and other data from a compromised host.


InvisiMole can collect data from the system, and can monitor changes in specified directories.


Ixeshe can collect data from a local system.


KGH_SPY can send a file containing victim system information to C2.


KONNI has stored collected information and discovered processes in a tmp file.


Kazuar uploads files from a specified directory to the C2 server.


Ke3chang gathered information and files from local directories for exfiltration.


Kevin can upload logs and other data from a compromised host.


Koadic can download files off the target system to send back to the server.


Lazarus Group has collected data and files from compromised networks.


LightNeuron can collect files from a local system.


Linfo creates a backdoor through which remote attackers can obtain data from local systems.


MCMD has the ability to upload files from an infected device.


MacMa can collect then exfiltrate files from the compromised system.


Machete searches the File system for files of interest.


Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.


Milan can upload files from a compromised host.


Misdat has collected files and data from a compromised host.


Nebulae has the capability to upload collected files to C2.


Neoichor can upload files from a victim's machine.


Operation Wocao has exfiltrated files and directories of interest from the targeted system.


Out1 can copy files and Registry data from compromised hosts.


P.A.S. Webshell has the ability to copy files on a compromised host.


PUNCHTRACK scrapes memory for properly formatted payment card data.


Patchwork collected and exfiltrated files from the infected system.


Pillowmint has collected credit card data using native API functions.


PingPull can collect data from a compromised host.


PoisonIvy creates a backdoor through which remote attackers can steal system information.


PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.


PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.


Proxysvc searches the local system and gathers data.


QuietSieve can collect files from a compromised host.


RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.


Ramsay can collect Microsoft Word documents from the target's file system, as well as ".txt", ".doc", and ".xls" files from the Internet Explorer cache.


RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.


SDBbot has the ability to access the file system on a compromised host.


SLOTHFULMEDIA has uploaded files and information from victim machines.


STARWHALE can collect data from an infected local host.


SUNBURST collected information from a compromised host.


Saint Bot can collect files and information from a compromised host.


Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.


ShimRat has the capability to upload collected files to a C2.


SideTwist has the ability to upload files from a compromised host.


SombRAT has collected data and files from a compromised host.


Stealth Falcon malware gathers data from the local victim system.


StrifeWater can collect data from a compromised host.


Taidoor can upload data and files from a victim's machine.


TajMahal has the ability to steal documents from the local system including the print spooler queue.


Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.


Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.


Ursnif has collected files from victim machines, including certificates and cookies.


WellMail can exfiltrate files from the victim machine.


WellMess can send files from the victim machine to C2.


Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.


XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.


Zox has the ability to upload files from a targeted system.


ZxShell can transfer files from a compromised host.


ZxxZ can collect data from a compromised host.


ccf32 can collect files from a compromised host.


creates a backdoor through which remote attackers can steal system information.


esentutl can be used to collect data from local file systems.


menuPass has collected various files from the compromised computers.


njRAT can collect data from a local system.


xCaon has uploaded files from victims' machines.


yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.


After compromising a victim, Poseidon Group discovers all running services.


Aquatic Panda has attempted to discover services for third party EDR products.


BBSRAT can query service configuration information.


BRONZE BUTLER has used TROJ_GETVERSION to discover system services.


Babuk can enumerate all services running on a compromised host.


BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.


Caterpillar WebShell can obtain a list of the services from a system.


Chimera has used "net start" and "net use" for system service discovery.


Cobalt Strike can enumerate services on compromised hosts.


Comnie runs the command: "net start >> %TEMP%\info.dat" on a victim.


Cuba can query service status using "QueryServiceStatusEx" function.


During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.


During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.


Earth Lusca has used Tasklist to obtain information from a compromised host.


Emissary has the capability to execute the command "net start" to interact with services.


GravityRAT has a feature to list the available services on the system.


GreyEnergy enumerates all Windows services.


Heyoka Backdoor can check if it is running as a service on a compromised host.


HotCroissant has the ability to retrieve a list of services on the infected host.


Hydraq creates a backdoor through which remote attackers can monitor services.


Ke3chang performs service discovery using "net start" commands.


Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.


Kwampirs collects a list of running services with the command "tasklist /svc".


LookBack can enumerate services on the victim machine.


OilRig has used "sc query" on a victim to gather information about services.


Operation Wocao has used the "tasklist" command to search for one of its backdoors.


RATANKBA uses "tasklist /svc" to display running tasks.


SILENTTRINITY can search for modifiable services that could be used for privilege escalation.


SLOTHFULMEDIA has the capability to enumerate services.


The "net start" command can be used in Net to find information about Windows services.


TrickBot collects a list of install programs and services on the system’s machine.


Turla surveys a system upon check-in to discover running services and associated processes using the "tasklist /svc" command.


Ursnif has gathered information about running services.


Volgmer queries the system to identify existing services.


ZLib has the ability to discover and manipulate Windows services.


ZxShell can check the services on the system.


admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: "net start >> %temp%\download"


APT41 used the Steam community page as a fallback mechanism for C2.


Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.


AppleSeed can use a second channel for C2 when the primary channel is in upload mode.


BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.


BlackEnergy has the capability to communicate over a backup channel via plus.google.com.


Bumblebee can use backup C2 servers if the primary server fails.


CHOPSTICK can switch to a new C2 channel if the current one is broken.


Carbanak’s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.


Cardinal RAT can communicate over multiple C2 host and port combinations.


CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.


Crutch has used a hardcoded GitHub repository as a fallback channel.


During Night Dragon, threat actors used company extranet servers as secondary C2 servers.


DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.


Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.


Exaramel for Linux can attempt to find a new C2 server if it receives an error.


FatDuke has used several C2 servers per targeted organization.


Gelsemium can use multiple domains and protocols in C2.


HOPLIGHT has multiple C2 channels in place in case one fails.


InvisiMole has been configured with several servers available for alternate C2 communications.


Kazuar can accept multiple URLs for C2 servers.


Kevin can assign hard-coded fallback domains for C2.


Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.


Linfo creates a backdoor through which remote attackers can change C2 servers.


Machete has sent data over HTTP if FTP failed, and has also used a fallback server.


MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.


Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.


NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.


PipeMon can switch to an alternate C2 domain when a particular date has been reached.


QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.


RDAT has used HTTP if DNS C2 communications were not functioning.


RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.


S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.


Shark can update its configuration to use a different C2 server.


SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.


SslMM has a hard-coded primary and backup C2 string.


TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.


The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.


TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.


TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.


Valak can communicate over multiple C2 hosts.


Aria-body has the ability to identify the titles of running windows on a compromised host.


Attor can obtain application window titles and then determines which windows to perform Screen Capture on.


Cadelspy has the ability to identify open windows on the compromised host.


Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.


DarkWatchman reports window names along with keylogger information to provide application context.


Flagpro can check the name of the window displayed on the system.


FunnyDream has the ability to discover application windows via execution of `EnumWindows`.


Grandoreiro can identify installed security tools based on window names.


HotCroissant has the ability to list the names of all open windows on the infected host.


InvisiMole can enumerate windows and child windows on a compromised host.


Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.


Metamorfo can enumerate all windows on the victim’s machine.


NETWIRE can discover and close windows on controlled systems.


NetTraveler reports window names along with keylogger information to provide application context.


PLEAD has the ability to list open windows on the compromised host.


PowerDuke has a command to get text of the current foreground window.


ROKRAT can use  the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.


SOUNDBITE is capable of enumerating application windows.


The discovery modules used with Duqu can collect information on open windows.


Trojan.Karagany can monitor the titles of open windows to identify specific keywords.


njRAT gathers information about opened windows during the initial infection.


A Threat Group-3390 tool can read and decrypt stored Registry values.


A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key "SYSTEM\CurrentControlSet\Control\Lsa Name".


ADVSTORESHELL can enumerate registry keys.


APT32's backdoor can query the Windows Registry to gather system information.


APT39 has used various strains of malware to query the Registry.


Attor has opened the registry and performed query searches.


BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.


BabyShark has executed the "reg query" command for "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default".


Bankshot searches for certain Registry keys to be configured before executing the payload.


Bazar can query "Windows\CurrentVersion\Uninstall" for installed applications.


BendyBear can query the host's Registry key at "HKEY_CURRENT_USER\Console\QuickEdit" to retrieve data.


Brave Prince gathers information about the Registry.


Bumblebee can check the Registry for specific keys.


CHOPSTICK provides access to the Windows Registry, which can be used to gather information.


Carbanak checks the Registry key "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" for proxy configurations information.


Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.


CharmPower has the ability to enumerate `Uninstall` registry values.


Clambling has the ability to enumerate Registry keys, including "KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir" to search for a bitcoin wallet.


Cobalt Strike can query "HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\"  to determine if the security setting for restricting default programmatic access is enabled.


ComRAT can check the default browser by querying "HKCR\http\shell\open\command".


Denis queries the Registry for keys and values.


Dragonfly 2.0 queried the Registry to identify victim information.


Dragonfly has queried the Registry to identify victim information.


Epic uses the "rem reg query" command to obtain values from Registry keys.


FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.


FatDuke can get user agent strings for the default browser from "HKCU\Software\Classes\http\shell\open\command".


Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.


Gold Dragon enumerates registry keys with the command "regkeyenum" and obtains information for the Registry key "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run".


Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.


Industroyer has a data wiper component that enumerates keys in the Registry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services".


InvisiMole can enumerate Registry values, keys, and data.


Kimsuky has obtained specific Registry keys and values on a compromised host.


Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:"HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt".


Lucifer can check for existing stratum cryptomining information in "HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%".


Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.


Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.


OSInfo queries the registry to look for information about Terminal Services.


OilRig has used "reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”" on a victim to query the Registry.


Operation Wocao has queried the registry to detect recent PuTTY sessions.


POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.


PcShare can search the registry files of a compromised host.


Pillowmint has used shellcode which reads code stored in the registry keys "\REGISTRY\SOFTWARE\Microsoft\DRM" using the native Windows API as well as read "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" as part of its C2.


Proxysvc gathers product names from the Registry key: "HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName" and the processor description from the Registry key "HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString".


ROKRAT can access the "HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData" Registry key to obtain the System manufacturer value to identify the machine type.


Reaver queries the Registry to determine the correct Startup path to use for persistence.


Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.


SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.


Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.


Sibot has queried the registry for proxy server information.


Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.


StoneDrill has looked in the registry to find the default browser path.


TEARDROP checked that "HKU\SOFTWARE\Microsoft\CTF" existed before decoding its embedded payload.


Taidoor can query the Registry on compromised hosts using "RegQueryValueExA".


TinyTurla can query the Registry for its configuration information.


Turla surveys a system upon check-in to discover information in the Windows Registry with the "reg query" command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .


Valak can use the Registry for code updates and to collect credentials.


Volgmer checks the system for certain Registry keys.


WastedLocker checks for specific registry keys related to the "UCOMIEnumConnections" and "IActiveScriptParseProcedure32" interfaces.


Waterbear can query the Registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"" to see if the value `OracleOcilib` exists.


ZIRCONIUM has used a tool to query the Registry for proxy settings.


Zeus Panda checks for the existence of a Registry key and if it contains certain values.


ZxShell can query the netsvc group value data located in the svchost group Registry key.


ZxxZ can search the registry of a compromised host.


gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.


njRAT can read specific registry values.


APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.


APT41 deployed rootkits on Linux systems.


Caterpillar WebShell has a module to use a rootkit on a system.


Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.


Ebury has used user mode rootkit techniques to remain hidden on the system.


HIDEDRV is a rootkit that hides certain operating system artifacts.


Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.


HiddenWasp uses a rootkit to hook and implement functions on the system.


LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.


PoisonIvy starts a rootkit from a malicious file dropped to disk.


Ramsay has included a rootkit to evade defenses.


Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.


Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.


Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.


Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.


WarzoneRAT can include a rootkit to hide processes, files, and startup.


Winnti Group used a rootkit to modify typical server functionality.


Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.


A JHUHUGIT variant gathers network interface card information.


A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.


APT1 used the "ipconfig /all" command to gather network configuration information.


APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.


APT41 collected MAC addresses from victim machines.


Action RAT has the ability to collect the MAC address of an infected host.


AdFind can extract subnet information from Active Directory.


Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.


Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.


Amadey can identify the IP address of a victim machine.


AppleSeed can identify the IP of a targeted system.


Astaroth collects the external IP address from the system.


Azorult can collect host IP information from the victim’s machine.


BADCALL collects the network adapter information.


BADFLICK has captured victim IP address details.


BLINDINGCAN has collected the victim machine's local IP address information and MAC address.


Backdoor.Oldrea collects information about the Internet adapter configuration.


Bazar can collect the IP address and NetBIOS name of an infected machine.


BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.


Bonadan can find the external IP address of the infected host.


BoxCaon can collect the victim's MAC address by using the "GetAdaptersInfo" API.


Calisto runs the "ifconfig" command to obtain the IP address from the victim’s machine.


Carbon can collect the IP address of the victims and other computers on the network using the commands: "ipconfig -all" "nbtstat -n", and "nbtstat -s".


Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.


Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.


CharmPower has the ability to use "ipconfig" to enumerate system network settings.


Chimera has used ipconfig, Ping, and "tracert" to enumerate the IP address and network environment and settings of the local host.


Clambling can enumerate the IP address of a compromised machine.


Cobalt Strike can determine the IP addresses of domain controllers.


Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.


Comnie uses "ipconfig /all" and "route PRINT" to identify network adapter and interface information.


Conti can retrieve the ARP cache from the local system by using the "GetIpNetTable()" API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.


CrackMapExec can collect DNS information from the targeted system.


Crimson contains a command to collect the victim MAC address and LAN IP.


Cuba can retrieve the ARP cache from the local system by using "GetIpNetTable".


Denis uses "ipconfig" to gather the IP address from the system.


Diavol can enumerate victims' local and external IPs when registering with C2.


Dragonfly 2.0 used batch scripts to enumerate network information, including information about trusts, zones, and the domain.


Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.


Dtrack can collect the host's IP addresses using the "ipconfig" command.


During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.


During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.


During FunnyDream, the threat actors used ipconfig for discovery on remote systems.


During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.


During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.


Dyre has the ability to identify network settings on a compromised host.


Earth Lusca used the command "ipconfig" to obtain information about network configurations.


Elise executes "ipconfig /all" after initial communication is made to the remote server.


Emissary has the capability to execute the command "ipconfig /all".


Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.


Epic uses the "nbtstat -n" and "nbtstat -s" commands on the victim’s machine.


Explosive has collected the MAC address from the victim's machine.


FELIXROOT collects information about the network including the IP address and DHCP server.


FatDuke can identify the MAC address on the target computer.


Felismus collects the victim LAN IP address and sends it to the C2 server.


Flagpro has been used to execute the "ipconfig /all" command on a victim system.


FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.


GALLIUM used "ipconfig /all" to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.


GeminiDuke collects information on network settings and Internet proxy settings from the victim.


GoldMax retrieved a list of the system's network interface after execution.


Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.


GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.


GrimAgent can enumerate the IP and domain of a target system.


HotCroissant has the ability to identify the IP address of the compromised machine.


Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.


Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.


Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.


JPIN can obtain network information, including DNS, IP, and proxies.


KEYMARBLE gathers the MAC address of the victim’s machine.


KONNI can collect the IP address from the victim’s machine.


Kazuar gathers information about network adapters.


Kobalos can record the IP address of the target machine.


Kwampirs collects network adapter and interface information by using the commands "ipconfig /all", "arp -a" and "route print". It also collects the system's MAC address with "getmac" and domain configuration with "net config workstation".


Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.


LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.


Lizar can retrieve network information from a compromised host.


Lokibot has the ability to discover the domain name of the infected host.


LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.


Lucifer can collect the IP address of a compromised host.


MacMa can collect IP addresses from a compromised host.


Machete collects the MAC address of the target computer and other network configuration information.


Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.


Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.


Mis-Type may create a file containing the results of the command "cmd.exe /c ipconfig /all".


More_eggs has the capability to gather the IP address from the victim's machine.


NETWIRE can collect the IP address of a compromised host.


NOKKI can gather information on the victim IP address.


Naid collects the domain name from a compromised host.


Naikon uses commands such as "netsh interface show" to discover network interface settings.


NanHaiShu can gather information about the victim proxy server.


Neoichor can gather the IP address from an infected host.


OSInfo discovers the current domain information.


OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.


OceanSalt can collect the victim’s IP address.


OilRig has run "ipconfig /all" on a victim.


Okrum can collect network information, including the host IP address, DNS, and proxy information.


Olympic Destroyer uses API calls to enumerate the infected system's ARP table.


Operation Wocao has discovered the local network configuration with ipconfig.


Orz can gather victim proxy information.


POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.


POWRUNER may collect network configuration data by running "ipconfig /all" on a victim.


Pay2Key can identify the IP and MAC addresses of the compromised host.


PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.


Penquin can report the IP of the compromised host to attacker controlled infrastructure.


PingPull can retrieve the IP address of a compromised host.


PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.


PoshC2 can enumerate network adapter information.


Proxysvc collects the network adapter information and domain/username information based on current remote sessions.


Pysa can perform network reconnaissance using the Advanced IP Scanner tool.


QUADAGENT gathers the current domain the victim system belongs to.


QakBot can use "net config workstation", "arp -a", and "ipconfig /all" to gather network configuration information.


RATANKBA gathers the victim’s IP address via the "ipconfig -all" command.


Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.


Reaver collects the victim's IP address.


RedLeaves can obtain information about network parameters.


Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.


Revenge RAT collects the IP address and MAC address from the system.


Rifdoor has the ability to identify the IP address of the compromised host.


Rising Sun can detect network adapter and IP address information.


RogueRobin gathers the IP address and domain from the victim’s machine.


Ryuk has called "GetIpNetTable" in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.


S-Type has used `ipconfig /all` on a compromised host.


SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.


SHARPSTATS has the ability to identify the domain of the compromised host.


STARWHALE has the ability to collect the IP address of an infected host.


Sandworm Team checks for connectivity to other resources in the network.


ShadowPad has collected the domain name of the victim system.


Shamoon obtains the target's IP address and local network segment.


Sibot checked if the compromised system is configured to use proxies.


SideCopy has identified the IP address of a compromised host.


SideTwist has the ability to collect the domain name on a compromised host.


Sidewinder has used malware to collect information on network interfaces, including the MAC address.


Small Sieve can obtain the IP address of a victim host.


SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via "ipconfig.exe /all".


SpicyOmelette can identify the IP of a compromised system.


Squirrelwaffle has collected the victim’s external IP address.


Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.


Stuxnet collects the IP address of a compromised system.


Sys10 collects the local IP address of the victim and sends it to the C2.


T9000 gathers and beacons the MAC and IP addresses during installation.


TSCookie has the ability to identify the IP of the infected host.


Taidoor has collected the MAC address of a compromised host; it can also use "GetAdaptersInfo" to identify network adapters.


TajMahal has the ability to identify the MAC address on an infected host.


TeamTNT has enumerated the host machine’s IP address.


The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.


Threat Group-3390 actors use NBTscan to discover vulnerable systems.


Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.


Trojan.Karagany can gather information on the network configuration of a compromised host.


UPPERCUT has the capability to gather the victim's proxy information.


USBferry can detect the infected machine's network topology using "ipconfig" and "arp".


Unknown Logger can obtain information about the victim's IP address.


Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.


Volgmer can gather the IP address from the victim's machine.


WannaCry will attempt to determine the local network segment it is a part of.


WellMail can identify the IP address of the victim system.


Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.


ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.


Zebrocy runs the "ipconfig /all" command.


ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.


admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: "ipconfig /all >> %temp%\download"


ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.


ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.


jRAT can gather victim internal and external IPs.


nbtstat can be used to discover local NetBIOS domain names.


route can be used to discover routing configuration information.


xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.


yty runs "ipconfig /all" and collects the domain name.


zwShell can obtain the victim IP address.


During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.


GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.


HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.


Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.


QakBot can measure the download speed on a targeted host.


QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).


Rising Sun can test a connection to a specified network IP address over a specified port number.


SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.


Turla has used "tracert" to check internet connectivity.


UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.


APT29 has used AdFind to enumerate remote systems.


APT3 has a tool that can detect the existence of remote systems.


APT32 has enumerated DC servers using the command "net group "Domain Controllers" /domain". The group has also used the "ping" command.


APT39 has used NBTscan and custom tools to discover remote systems.


AdFind has the ability to query Active Directory for computers.


BRONZE BUTLER typically use "ping" and Net to enumerate systems.


Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.


BitPaymer can use "net view" to discover remote systems.


BloodHound can enumerate and collect the properties of domain computers, including domain controllers.


Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.


Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.


Commands such as "net view" can be used in Net to gather information about available remote systems.


Conti has the ability to discover hosts on a target network.


DRATzarus can search for other machines connected to compromised host and attempt to map the network.


Diavol can use the ARP table to find remote hosts to scan.


During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.


During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.


During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.


Earth Lusca used the command "powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -
property * | findstr “Address””" to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.


Epic uses the "net view" command on the victim’s machine.


FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.


FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.


FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used "nltest.exe /dclist" to retrieve a list of domain controllers.


Flagpro has been used to execute "net view" on a targeted system.


Fox Kitten has used Angry IP Scanner to detect remote systems.


GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as "ping" to identify remote systems.


HEXANE has used `net view` to enumerate domain machines.


Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.


Industroyer can enumerate remote computers in the compromised network.


Ke3chang has used network scanning and enumeration tools, including Ping.


Kwampirs collects a list of available servers with the command "net view".


MURKYTOP has the capability to identify remote hosts on connected networks.


NBTscan can list NetBIOS computer names.


Naikon has used a netbios scanner for remote machine identification.


Nltest may be used to enumerate remote domain controllers using options such as "/dclist" and "/dsgetdc".


OSInfo performs a connection test to discover remote systems in the network


Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.


Operation Wocao can use the "ping" command to discover remote systems.


Ping can be used to identify remote systems within a network.


PoetRAT used Nmap for remote system discovery.


QakBot can identify remote systems through the "net view" command.


RATANKBA runs the "net view /domain" and "net view" commands.


ROADTools can enumerate Azure AD systems and devices.


SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.


SILENTTRINITY can enumerate and collect the properties of domain computers.


Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.


Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.


SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.


Sykipot may use "net view /domain" to display hostnames of available systems on a network.


TRITON’s TsLow python module pings controllers over the TriStation protocol.


The TAINTEDSCRIBE command and execution module can perform target system enumeration.


Threat Group-3390 has used the "net view" command.


TrickBot can enumerate computers and network devices.


Turla surveys a system upon check-in to discover remote systems on a local network using the "net view" and "net view /DOMAIN" commands. Turla has also used "net group "Domain Computers" /domain", "net group "Domain Controllers" /domain", and "net group "Exchange Servers" /domain" to enumerate domain computers, including the organization's DC and Exchange Server.


WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.


Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind and "nltest/dclist" to enumerate domain computers, including the domain controller.


menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command "net view /domain" to a PlugX implant to gather information about remote systems on the network.


njRAT can identify remote hosts on connected networks.


CosmicDuke exfiltrates collected files automatically over FTP to remote servers.


Crutch has automatically exfiltrated stolen files to Dropbox.


Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.


During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.


Ebury can automatically exfiltrate gathered SSH credentials.


Empire has the ability to automatically send collected data back to the threat actors' C2.


Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.


LightNeuron can be configured to automatically exfiltrate files under a specified directory.


OutSteel can automatically upload collected files to its C2 server.


Peppy has the ability to automatically exfiltrate files and keylogs.


Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.


ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.


Sidewinder has configured tools to automatically send collected files to attacker controlled servers.


StrongPity can automatically exfiltrate collected documents to the C2 server.


TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.


MacMa can manage remote screen sessions.


APT29 has used RDP sessions from public-facing systems to internal servers.


Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.


Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.


Chimera has used RDP to access targeted systems.


Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.


DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.


FIN6 used RDP to move laterally in victim networks.


FIN7 has used RDP to move laterally in victim environments.


Fox Kitten has used RDP to log in and move laterally in the target environment.


Kimsuky has used RDP for direct remote point-and-click access.


Leviathan has targeted RDP credentials and used it to move through the victim environment.


Magic Hound has used Remote Desktop Services on targeted systems.


OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.


Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.


QuasarRAT has a module for performing remote desktop access.


ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.


Silence has used RDP for lateral movement.


Stolen Pencil utilized RDP for direct remote point-and-click access.


TEMP.Veles utilized RDP throughout an operation.


The APT1 group is known to have used RDP during operations.


Wizard Spider has used RDP for lateral movement.


menuPass has used RDP connections to move across the victim network.


APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.


APT41 has transferred implant files using Windows Admin Shares.


Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.


Anchor can support windows execution via SMB shares.


BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.


Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.


Chimera has used Windows admin shares to move laterally.


Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.


Conficker variants spread through NetBIOS share propagation.


Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.


Deep Panda uses net.exe to connect to network shares using "net use" commands with compromised credentials.


Diavol can spread throughout a network via SMB prior to encryption.


FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.


HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.


Lateral movement can be done with Net through "net use" commands to connect to the on remote systems.


Lazarus Group malware SierraAlfa accesses the "ADMIN$" share via SMB to conduct lateral movement.


Moses Staff has used batch scripts that can enable SMB on a compromised host.


Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.


Olympic Destroyer uses PsExec to interact with the "ADMIN$" network share to execute commands on remote systems.


Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.


Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.


PsExec, a tool that has been used by adversaries, writes programs to the "ADMIN$" network share to execute commands on remote systems.


Sandworm Team has run "net use" to connect to network shares.


Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.


Stuxnet propagates to available network shares.


The Regin malware platform can use Windows admin shares to move laterally.


Threat Group-1314 actors mapped network drives using "net use".


Turla used "net use" commands to connect to lateral systems within a network.


Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.


Zox has the ability to use SMB for communication.


zwShell has been copied over network shares to move laterally.


Cobalt Strike can deliver "beacon" payloads for lateral movement by leveraging remote COM execution.


Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.


SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.


APT39 used secure shell (SSH) to move laterally among their targets.


BlackTech has used Putty for remote access.


Cobalt Strike can SSH to a remote service.


Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.


FIN7 has used SSH to move laterally through victim environments.


Kinsing has used SSH for lateral movement.


Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.


Leviathan used ssh for internal reconnaissance.


TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.


TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.


menuPass has used Putty Secure Copy Client (PSCP) to transfer data.


DanBot can use VNC for remote access to targeted systems.


FIN7 has used TightVNC to control compromised hosts.


Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.


Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.


ZxShell supports functionality for VNC sessions.


APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts.


SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.


Threat Group-3390 has used WinRM to enable remote execution.


UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts.


A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.


An APT28 backdoor may collect the entire contents of an inserted USB device.


AppleSeed can find and collect data from removable media devices.


Aria-body has the ability to collect data from USB devices.


BADNEWS copies files with certain extensions from USB devices to
a predefined directory.


Explosive can scan all .exe files located in the USB drive.


FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.


GravityRAT steals files based on an extension list if a USB drive is connected to the system.


Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives.


ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.


Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.


Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.


Ramsay can collect data from removable media and stage it for exfiltration.


Remsec has a package that collects documents from any inserted USB sticks.


TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.


The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.


Turla RPC backdoors can collect files from USB thumb drives.


A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.


A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.


A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.


A Volgmer variant is encoded using a simple XOR cipher.


APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.


APT18 obfuscates strings in the payload.


APT19 used Base64 to obfuscate commands and the payload.


APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.


APT29 has used encoded PowerShell commands.


APT3 obfuscates files or information to help evade defensive measures.


APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation. APT32 has also encoded payloads using Base64 and a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.


APT33 has used base64 to encode payloads.


APT34 has used base64-encoded files that are dropped to victims.


Action RAT's commands, strings, and domains can be Base64 encoded within the payload.


Anchor has obfuscated code with stack strings and string encryption.


AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.


AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.


Aria-body has used an encrypted configuration file for its loader.


Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys.


Avenger has the ability to XOR encrypt files to be sent to C2.


BLINDINGCAN has obfuscated code using Base64 encoding.


BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.


BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.


Bazar has used XOR, RSA2, and RC4 encrypted files.


BendyBear has encrypted payloads using RC4 and XOR.


BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.


BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.


Blue Mockingbird has obfuscated the wallet address in the payload binary.


BoomBox can encrypt data using AES prior to exfiltration.


Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.


CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.


Carbanak encrypts strings to make analysis more difficult.


Carberp has used XOR-based encryption to mask C2 server locations within the trojan.


Chimera has encoded PowerShell commands.


Chinoxy has encrypted its configuration file.


Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.


Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.


CoinTicker initially downloads a hidden encoded file.


ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts.


Comnie uses RC4 and Base64 to obfuscate strings.


Conficker has obfuscated its code to prevent its removal from host machines.


Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.


CookieMiner has used base64 encoding to obfuscate scripts on the system.


Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.


DRATzarus can be partly encrypted with XOR.


Dacls can encrypt its configuration file with AES CBC.


Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.


DarkWatchman has used Base64 to encode PowerShell commands. DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.


Denis obfuscates its code and encrypts the API names. Denis also encodes its payload in Base64.


Diavol has Base64 encoded the RSA public key used for encrypting files.


Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.


Dridex's strings are obfuscated using RC4.


Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.


Drovorub has used XOR encrypted payloads in WebSocket client to server messages.


Dtrack has used a dropper that embeds an encrypted payload as extra data.


During C0015, the threat actors used Base64-encoded strings.


During Frankenstein, the threat actors ran encoded commands from the command line.


During Night Dragon, threat actors used a DLL that included an XOR-encoded section.


During Operation CuckooBees, the threat actors executed an encoded VBScript file.


During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.


During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.


EKANS uses encoded strings in its process kill list.


Earth Lusca used Base64 to encode strings.


Ebury has obfuscated its strings with a simple XOR encryption with a static key.


Elderwood has encrypted documents and malicious executables.


Elise encrypts several of its files, including configuration files.


Ember Bear has obfuscated malware and malicious scripts to help avoid detection.


Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.


Exaramel for Linux uses RC4 for encrypting the configuration.


Exaramel uses RC4 for encrypting the configuration.


FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.


FIN6 has used encoded PowerShell commands.


FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.


FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.


FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.


Flagpro has been delivered within ZIP or RAR password-protected archived files.


FlawedGrace encrypts its C2 configuration files with AES in CBC mode.


For Operation Spalax, the threat actors used XOR-encrypted payloads.


Frankenstein has run encoded commands from the command line.


FruitFly executes and stores obfuscated Perl scripts.


GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.


GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.


Gallmaker obfuscated shellcode used during execution.


Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.


Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.


Gelsemium has the ability to compress its components.


GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.


GoldenSpy's uninstaller has base64-encoded its variables.


Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.


GravityRAT supports file encryption (AES with the key "lolomycin2017").


GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.


GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.


Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.


H1N1 uses multiple techniques to obfuscate strings, including XOR.


HAWKBALL has encrypted the payload with an XOR-based algorithm.


HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.


HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.


HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.


Hi-Zor uses various XOR techniques to obfuscate its components.


HiddenWasp encrypts its configuration and payload.


Higaisa used Base64 encoded compressed payloads.


HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.


ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.


IceApple can use Base64 and "junk" JavaScript code to obfuscate information.


If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an Alternate Data Stream (ADS) named kernel32.dll that is saved in "%PROGRAMDATA%\Windows\".


Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.


In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.


Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.


InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.


InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.


KGH_SPY has used encrypted strings in its installer.


KOCTOPUS has obfuscated scripts with the BatchEncryption tool.


KONNI is heavily obfuscated and includes encrypted configuration files.


Kerrdown can encrypt, encode, and compress multiple layers of shellcode.


Kessel's configuration is hardcoded and RC4 encrypted within the binary.


Kevin has Base64-encoded its configuration file.


KillDisk uses VMProtect to make reverse engineering the malware more difficult.


Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.


LazyScripter has leveraged the BatchEncryption tool to perform advanced batch obfuscation and encoding techniques.


Leviathan has obfuscated code using base64 and gzip compression.


LightNeuron encrypts its configuration files with AES-256.


Lokibot has obfuscated strings with base64 encoding.


LoudMiner has obfuscated various scripts and encrypted DMG files.


MCMD can Base64 encode output strings prior to sending to C2.


Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.


Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.


Many strings in JHUHUGIT are obfuscated with a XOR algorithm.


Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.


Metamorfo has encrypted payloads and strings.


Micropsia obfuscates the configuration with a custom Base64 and XOR.


Milan can encode files containing information about the targeted system.


Molerats has delivered compressed executables within ZIP files to victims.


More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.


Moses Staff has used obfuscated web shells in their operations.


Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.


Most strings in USBStealer are encrypted using 3DES and XOR and reversed.


MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.


NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.


OLDBAIT obfuscates internal strings and unpacks them at startup.


Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.


P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.


POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.


POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.  POWERSTATS has used PowerShell code with custom string obfuscation


PS1 is distributed as a set of encrypted files and scripts.


PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.


PlugX can use API hashing and modify the names of strings to evade detection.