Technique:  Obtain Capabilities:Tool
It obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.
It obtained and used a modified variant of Imminent Monitor.
It has used various open-source tools for privilege escalation purposes.
It has obtained and used publicly-available tools like Empire.
It has obtained and used open-source tools like Koadic, Mimikatz, and Responder.
It has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.
It has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.
It has obtained and leveraged publicly-available tools for early intrusion activities.
It has obtained and used open-source tools such as Mimikatz.
It has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.
It has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
It has acquired and used Cobalt Strike in its operations.
It has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.
It has obtained tools such as PuTTY for use in their operations.
It has obtained and used tools such as Putty, SNScan, and PsExec for its operations.
It has obtained and used tools such as Mimikatz.
It has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.
For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.
For C0015, the threat actors obtained a variety of tools, including AdFind,  AnyDesk, and Process Hacker.
For C0017, It obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.
For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.
For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.
During C0027, It obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.
It has obtained and used open-source tools such as PsExec and Mimikatz.
It has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
It has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
It has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.
It has used Metasploit, Empire, and AirVPN for post-exploitation activities.
During CostaRicto, the threat actors obtained open source tools to use in their operations.
It has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.
It has obtained and used tools such as Impacket, Winexe, and PsExec.
It has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.
It has acquired and used a variety of open source tools.
It has obtained and used open source scripts from GitHub.
It has obtained open source tools for its operations, including JsonCPP and Psiphon.
It has relied on publicly-available software to gain footholds and establish persistence in victim environments.
It has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.
It has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.
It has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.
It has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.
It has used open-source tools such as Impacket for targeting efforts.
For Frankenstein, the threat actors obtained and used Empire.
For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.
It has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.
It has obtained and used tools such as QuasarRAT and Remcos.
It has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.
It has obtained and used open-source tools such as LaZagne.
It has acquired open source tools such as NBTscan and Meterpreter for their operations.
It has obtained and used tools such as Mimikatz.
It has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.
It has obtained tools such as RVTools and AD Explorer for their operations.
It has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.
It has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.
It has obtained an ARP spoofing tool from GitHub.
It has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.
It has used and modified open-source tools like Impacket, Mimikatz, and pwdump.
It has used Microsoft's Console Debugger in some of their operations.
It has used the commercial tool DiskCryptor.
It has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.
During Night Dragon, threat actors obtained and used tools such as gsecdump.
For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.
For Operation Dream Job, It obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.
For Operation Spalax, the threat actors obtained packers such as CyaX.
For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.
It has obtained and used open-source tools such as QuasarRAT.
It has obtained and used tools such as Mimikatz and gsecdump.
It has obtained and used tools such as AirVPN and plink in their operations.
It has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to It's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations.
It has obtained and modified versions of publicly-available tools like Empire and PsExec.
It has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.
It has used commodity remote access tools.
It has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.
It has obtained and used tools such as Mimikatz and PsExec.
It has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.
It has obtained and used tools such as Mimikatz and PsExec.
It has obtained and customized publicly-available tools like Mimikatz.
It has used customized versions of open-source tools for C2.
It has obtained and used tools such as Mimikatz.
It has obtained and used Empire for post-exploitation activities.
It has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.