KJChen/tech2proc huggingface dataset:
Technique:  Active Scanning:Scanning IP Blocks
It has scanned specific lists of target IP addresses.
Technique:  Active Scanning:Vulnerability Scanning
It has performed large-scale scans in an attempt to find vulnerable servers.
It has conducted widespread scanning of target environments to identify vulnerabilities for exploit.
It has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).
It has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.
It has scanned for vulnerabilities in the public-facing servers of their targets.
It has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.
It has scanned network infrastructure for vulnerabilities as part of its operational planning.
It has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.
It has performed vulnerability scans of the target server.
Technique:  Active Scanning:Wordlist Scanning
It has used DirBuster and GoBuster to brute force web directories and DNS subdomains.
Technique:  Gather Victim Host Information:Software
It has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.
It has captured the user-agent strings from visitors to their phishing sites.
It has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. It also collected a list of computers using specific software as part of its targeting efforts.
Technique:  Gather Victim Host Information:Client Configurations
It has interacted with Office 365 tenants to gather details regarding target's environments.
Technique:  Gather Victim Identity Information
It has conducted targeted surveillance against activists and bloggers.
It has researched employees to target for social engineering attacks.
It has identified specific potential victims at targeted organizations.
It has gathered detailed information of target employees to enhance their social engineering lures.
It has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
For Operation Dream Job, It conducted extensive reconnaissance research on potential targets.
During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.
Technique:  Gather Victim Identity Information:Credentials
It has harvested user's login credentials.
During C0027, It sent phishing messages via SMS to steal credentials.
It has collected credentials for the target organization from previous breaches for use in brute force attacks.
It has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.
It has collected compromised credentials to use for targeting efforts.
It gathered credentials from two victims that they then attempted to validate across 75 different websites. It has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.
For the SolarWinds Compromise, It conducted credential theft operations to obtain credentials to be used for access to victim environments.
Technique:  Gather Victim Identity Information:Email Addresses
AADInternals can check for the existence of user email addresses using public Microsoft APIs.
It has collected e-mail addresses for activists and bloggers in order to target them with spyware.
It has gathered targeted individuals' e-mail addresses through open source research and website contact forms.
It has collected e-mail addresses for users they intended to target.
It has targeted executives, human resources staff, and IT personnel for spearphishing.
It has collected valid email addresses that were subsequently used in spearphishing campaigns.
It has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.
It collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.
It has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.
It has specifically targeted government agency employees with spearphishing e-mails.
It has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.
It has collected e-mail addresses from targeted organizations from open Internet searches.
It has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.
Technique:  Gather Victim Identity Information:Employee Names
It has collected victim employee name information.
It's research of potential victim organizations included the identification and collection of employee information.
It has collected lists of names for individuals from targeted organizations.
Technique:  Gather Victim Network Information
It gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.
Technique:  Gather Victim Network Information:Domain Properties
AADInternals can gather information about a tenant’s domains using public Microsoft APIs.
It conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.
Technique:  Gather Victim Network Information:Network Topology
It has searched for infrastructure that can provide remote access to an environment for targeting efforts.
Technique:  Gather Victim Network Information:IP Addresses
It has limited its watering hole attacks to specific IP address ranges.
It has obtained IP addresses for publicly-accessible Exchange servers.
It has captured the IP addresses of visitors to their phishing sites.
Technique:  Gather Victim Org Information
It has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.
It has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.
For Operation Dream Job, It gathered victim organization information to identify specific targets.
Technique:  Gather Victim Org Information:Determine Physical Locations
It has collected location information from visitors to their phishing sites.
Technique:  Gather Victim Org Information:Business Relationships
It has collected open source information to identify relationships between organizations for targeting purposes.
It has gathered detailed knowledge of an organization's supply chain relationships.
In preparation for its attack against the 2018 Winter Olympics, It conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.
Technique:  Gather Victim Org Information:Identify Roles
It has identified executives, HR, and IT staff at victim organizations for further targeting.
It has gathered detailed knowledge of team structures within a target organization.
During Operation Dream Job, It targeted specific individuals within an organization with tailored job vacancy announcements.
Technique:  Phishing for Information
It has used spearphishing to compromise credentials.
It has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.
ItM targeted presidential campaign staffers with credential phishing e-mails.
Technique:  Phishing for Information:Spearphishing Service
During C0027, It sent Telegram messages impersonating IT personnel to harvest credentials.
Technique:  Phishing for Information:Spearphishing Attachment
It has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.
It has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.
It has sent e-mails with malicious attachments that lead victims to credential harvesting websites.
Technique:  Phishing for Information:Spearphishing Link
AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.
It has conducted credential phishing campaigns with embedded links to attacker-controlled domains.
It has used malicious links to direct users to web pages designed to harvest credentials.
It has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.
It has used links in e-mail to steal account information.
It has used SMS and email messages with links designed to steal credentials or track victims.
It has delivered web bugs to profile their intended targets.
It has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
It has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.
It has sent e-mails with malicious links to credential harvesting websites.
It has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.
SMOKEDHAM has been delivered via malicious links in phishing emails.
ItM has used web beacons in e-mails to track hits to attacker-controlled URL's.
Technique:  Phishing for Information:Spearphishing Voice
During C0027, It used phone calls to instruct victims to navigate to credential-harvesting websites.
It has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.
Technique:  Search Closed Sources
It has searched for information on targeted individuals on business databases including IttReach and CrunchBase.
Technique:  Search Closed Sources:Purchase Technical Data
It has purchased credentials and session tokens from criminal underground forums.
Technique:  Search Open Websites
It researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. It has also researched third-party websites to help it craft credible spearphishing emails.
It has copied data from social media sites to impersonate targeted individuals.
It has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.
For Operation Dream Job, It used LinkedIn to identify and target employees within a chosen organization.
It has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.
It has searched public code repositories for exposed credentials.
Technique:  Search Victim-Owned Websites
It has used contact forms on victim websites to generate phishing e-mails.
It has searched for information on the target company's website.
It has conducted research against potential victim websites as part of its operational planning.
It has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
Technique:  Acquire Infrastructure:DNS Server
It has acquired dynamic DNS services for use in the targeting of intended victims.
It has set up custom DNS servers to send commands to compromised hosts via TXT records.
Technique:  Acquire Infrastructure:Virtual Private Server
It has used VPS hosting providers in targeting of intended victims.
It has acquired VPS infrastructure for use in malicious campaigns.
It has operated from leased virtual private servers (VPS) in the United States.
It has used VPS hosting providers for infrastructure.
It has used Virtual Private Server (VPS) infrastructure.
Technique:  Acquire Infrastructure:Server
It has acquired multiple servers for some of their operations, using each server for a different role.
It has used Taiwan-based servers that appear to be exclusive to It.
It has purchased hosting servers with virtual currency and prepaid cards.
During Night Dragon, threat actors purchased hosted services to use for C2.
During Operation Dream Job, It acquired servers to host their malicious tools.
For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.
For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.
It has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.
Technique:  Acquire Infrastructure:Web Services
It has created profile pages in Microsoft TechNet that were used as C2 infrastructure.
It has used newly-created Blogspot pages for credential harvesting operations.
It has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. It has also used legitimate web services such as Dropbox and Constant Contact in their operations.
It has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.
It has obtained cloud storage service accounts to host stolen data.
It has established GitHub accounts to host their malware.
It has set up Amazon S3 buckets to host trojanized digital products.
It has acquired web services for use in C2 and exfiltration.
It created Dropbox accounts for their operations.
It has hosted content used for targeting efforts via web services such as Blogspot.
It has hosted malicious downloads on Github.
It has established GitHub accounts to host its toolsets.
It has acquired Amazon S3 buckets to use in C2.
It has used file sharing services including OneHub to distribute tools.
During Operation Dream Job, It used file hosting services like DropBox and OneDrive.
For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.
It has created and used legitimate Microsoft OneDrive accounts for their operations.
It has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.
It has created web accounts including Dropbox and GitHub for C2 and document exfiltration.
ItM has used GitHub to host malware linked in spearphishing e-mails.
Technique:  Compromise Accounts:Social Media Accounts
It has compromised social media accounts to conduct social engineering attacks.
Technique:  Compromise Accounts:Email Accounts
It has used compromised email accounts to send credential phishing emails.
It has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.
It has used compromised accounts to send spearphishing emails.
It has compromised legitimate email accounts to use in their spearphishing operations.
It has compromised email accounts to send spearphishing e-mails.
It has payed employees, suppliers, and business partners of target organizations for credentials.
It has compromised email accounts to conduct social engineering attacks.
It has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.
Technique:  Compromise Accounts:Cloud Accounts
It has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.
Technique:  Compromise Infrastructure:Domains
It hijacked FQDNs associated with legitimate websites hosted by hop points.
During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.
For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.
It has compromised legitimate sites and used them to distribute malware.
It has used compromised domains to host links targeted to specific phishing victims.
For Operation Dream Job, It compromised domains in Italy and other countries for their C2 infrastructure.
It has compromised domains for some of their infrastructure, including for C2 and staging malware.
For the SolarWinds Compromise, It compromised domains to use for C2.
It has compromised domains for use in targeted malicious campaigns.
Technique:  Compromise Infrastructure:DNS Server
It has reconfigured a victim's DNS records to actor-controlled domains and websites.
Technique:  Compromise Infrastructure:Virtual Private Server
It has used the VPS infrastructure of compromised Iranian threat actors.
Technique:  Compromise Infrastructure:Server
It has compromised otherwise legitimate sites as staging servers for second-stage payloads.
It has compromised legitimate websites to host C2 and malware modules.
It has used compromised web servers as part of their operational infrastructure.
It has served fake updates via legitimate websites that have been compromised.
It has compromised servers to stage malicious tools.
During Night Dragon, threat actors compromised web servers to use for C2.
For Operation Dream Job, It compromised servers to host their malicious tools.
For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.
It has used compromised servers as infrastructure.
It has used compromised PRTG servers from other organizations for C2.
Technique:  Compromise Infrastructure:Botnet
It has used large groups of compromised machines for use as proxy nodes.
It has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.
It has routed traffic through compromised small office and home office (SOHO) network equipment, many of which were located in the same geographic area as the victim.
Technique:  Compromise Infrastructure:Web Services
It has compromised Google Drive repositories.
It has frequently used compromised WordPress sites for C2 infrastructure.
Technique:  Develop Capabilities
It created and used a mailing toolkit to use in spearphishing attacks.
Technique:  Develop Capabilities:Malware
It has used custom malware, including Mongall and Heyoka Backdoor, in their operations.
It has used unique malware in many of their operations.
For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.
It has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.
For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.
It has utilized custom malware to maintain persistence in a compromised environment.
It has developed malware for use in operations, including the creation of infected removable media.
It has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.
It has developed custom malware that allowed them to maintain persistence on victim networks.
It has developed its own unique malware such as MailFetch.py for use in operations.
It has developed custom malware for use in their operations.
It has used unique malware for information theft and exfiltration.
It has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.
For Operation Dream Job, It developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.
For Operation Ghost, It used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.
For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.
During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.
It has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.
For the SolarWinds Compromise, It used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.
It has developed custom malware such as Hildegard.
It has developed its own unique malware for use in operations.
Technique:  Develop Capabilities:Code Signing Certificates
During Operation Dream Job, It digitally signed their malware and the dbxcli utility.
It has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.
It has created self-signed certificates to sign malicious installers.
Technique:  Develop Capabilities:Digital Certificates
It has created self-signed digital certificates to enable mutual TLS authentication for malware.
For C0011, It established SSL certificates on the typo-squatted domains the group registered.
It has created self-signed digital certificates for use in HTTPS C2 traffic.
Technique:  Establish Accounts
It has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, It has created biographical sections and posted in forum threads.
It has created KeyBase accounts to communicate with ransomware victims.
Technique:  Establish Accounts:Social Media Accounts
It has set up Facebook pages in tandem with fake websites.
It has created fake LinkedIn profiles that included profile photos, details, and connections.
It has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.
It has established social media profiles to mimic employees of targeted companies.
It has used a Twitter account to communicate with ransomware victims.
It has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.
It has created social media accounts to monitor news and security trends as well as potential targets.
It has created new Twitter accounts to conduct social engineering against potential victims.
It has created new social media accounts for targeting efforts.
It has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
For Operation Dream Job, It created fake LinkedIn accounts for their targeting efforts.
For Operation Ghost, It registered Twitter accounts to host C2 nodes.
It has established social media accounts to disseminate victim internal-only documents and other sensitive data.
Technique:  Establish Accounts:Email Accounts
It has created email accounts for later use in social engineering, phishing, and when registering domains.
It has created e-mail accounts to spoof targeted organizations.
For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.
It has established email accounts for use in domain registration including for ProtonMail addresses.
It has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.
It has created email accounts for phishing operations.
It has created new email accounts for spearphishing operations.
It has created new email accounts for targeting efforts.
It has established email accounts using fake personas for spearphishing operations.
It has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.
During Operation Dream Job, It created fake email accounts to correspond with fake LinkedIn personas; It also established email accounts to match those of the victim as part of their BEC attempt.
For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.
During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.
For Operation Wocao, the threat actors registered email accounts to use during the campaign.
It has created email accounts that mimic legitimate organizations for its spearphishing operations.
It has established e-mail accounts to receive e-mails forwarded from compromised accounts.
It has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.
Technique:  Obtain Capabilities:Malware
It has used a variety of publicly-available remote access Trojans (RATs) for its operations.
It used publicly available malware for privilege escalation.
It has acquired and used njRAT in its operations.
It has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
For C0015, the threat actors used Cobalt Strike and Conti ransomware.
It has acquired and used a variety of malware, including Cobalt Strike.
For FunnyDream, the threat actors used a new backdoor named FunnyDream.
It acquired and used the Redline password stealer in their operations.
It has used a variety of open-source remote access Trojans for its operations.
It has obtained and used malware such as Cobalt Strike.
It has used unique malware in their operations, including metaMain and Mafalda.
During Night Dragon, threat actors used Trojans from underground hacker websites.
For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.
It has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.
It has used malware such as Azorult and Cobalt Strike in their operations.
It has used malware obtained after compromising other threat actors, such as It.
Technique:  Obtain Capabilities:Code Signing Certificates
It has used stolen code-signing certificates for its malicious payloads.
It has stolen legitimate certificates to sign malicious payloads.
It has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.
MegaCortex has used code signing certificates issued to fake companies to bypass security controls.
During Operation Dream Job, It used code signing certificates issued by Sectigo RSA for some of its malware and tools.
It has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.
It has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.
Technique:  Obtain Capabilities:Digital Certificates
It has used valid, stolen digital certificates for some of their malware and tools.
It has obtained SSL certificates for their C2 domains.
It has used a valid digital certificate for some of their malware.
For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.
It has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
Technique:  Obtain Capabilities:Exploits
It has obtained exploit code for various CVEs.
Technique:  Obtain Capabilities:Vulnerabilities
In 2017, It conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.
Technique:  Stage Capabilities
It has used servers under their control to validate tracking pixels sent to phishing victims.
Technique:  Stage Capabilities:Upload Malware
It has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.
It has registered domains to stage payloads.
For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.
For C0011, It hosted malicious documents on domains registered by the group.
For C0021, the threat actors uploaded malware to websites under their control.
It has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.
It  has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.
It has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3.
It has registered domains to stage payloads.
It has staged malware on fraudulent websites set up to impersonate targeted organizations.
It has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.
It has hosted open-source remote access Trojans used in its operations in GitHub.
It has hosted malicious payloads on Dropbox.
It has hosted malicious payloads on DropBox including PlugX.
During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.
For Operation Dream Job, It used compromised servers to host malware.
For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.
For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.
It has used compromised domains to host its malicious payloads.
It has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.
It has staged malware on actor-controlled domains.
It has uploaded backdoored Docker images to Docker Hub.
It has hosted malicious payloads on Dropbox.
Technique:  Stage Capabilities:Upload Tool
For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.
For Operation Dream Job, It used multiple servers to host malicious tools.
It has staged tools, including gsecdump and WCE, on previously compromised websites.
Technique:  Stage Capabilities:Drive-by Target
It has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.
For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.
It has compromised websites to redirect traffic and to host exploit kits.
It has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.
It has redirected compromised machines to an actor-controlled webpage through HTML injection.
It has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.
It has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
Technique:  Stage Capabilities:Link Target
It has created a link to a Dropbox file that has been used in their spear-phishing operations.
It has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. It has also made use of a variety of URL shorteners for these staged websites.
Technique:  Content Injection
Disco has achieved initial access and execution through content injection into DNS,  HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.
It has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.
Technique:  Hardware Additions
It used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.
Technique:  Phishing
It has used spear phishing to initially compromise victims.
It has conducted malicious spam (malspam) campaigns to gain access to victim's machines.
Hikit has been spread through spear phishing.
Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.
Technique:  Phishing:Spearphishing via Service
It has used various social media channels to spearphish victims.
It has used the legitimate mailing service Constant Contact to send phishing e-mails.
It has used social media to deliver malicious files to victims.
It spearphished victims via Facebook and Whatsapp.
It has used the e-mail notification features of legitimate file sharing services for spearphishing.
It has used fake job advertisements sent via LinkedIn to spearphish targets.
It has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.
It used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.
It has used LinkedIn to send spearphishing links.
During Operation Dream Job, It sent victims spearphishing messages via LinkedIn concerning fictitious jobs.
It has used fake personas on social media to engage and target victims.
Technique:  Phishing:Spearphishing Voice
During C0027, It impersonated legitimate IT personnel in phone calls to direct victims to download a remote monitoring and management (RMM) tool that would allow the adversary to remotely control their system.
Technique:  Replication Through Removable Media
Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.
ANDROMEDA has been spread via infected USB keys.
It has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.
It uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.
Part of It's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.
Crimson can spread across systems by infecting removable media.
It's selective infector modifies executables stored on removable media as a method of spreading across computers.
DustySky searches for removable media and duplicates itself onto it.
It actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.
H1N1 has functionality to copy itself to removable media.
It has used malicious DLLs to spread malware to connected removable USB drives on infected machines.
It has used a customized PlugX variant which could spread through USB connections.
njRAT can be configured to spread via removable drives.
QakBot has the ability to use removable drives to spread through compromised networks.
Ramsay can spread itself by infecting other portable executable files on removable drives.
It may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.
It has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.
Unknown Logger is capable of spreading to USB devices.
Ursnif has copied itself to and infected removable drives for propagation.
USBferry can copy its installer to attached USB storage devices.
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.
Technique:  Supply Chain Compromise:Compromise Software Dependencies and Development Tools
XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.
Technique:  Supply Chain Compromise:Compromise Software Supply Chain
It gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.
CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.
It has compromised legitimate web browser updates to deliver a backdoor.
It has placed trojanized installers for control system software on legitimate vendor app stores.
It has gained initial access by compromising a victim's software supply chain.
It has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.
GoldenSpy has been packaged with a legitimate tax preparation software.
It has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.
During the SolarWinds Compromise, It gained initial network access to some victims via a trojanized update of SolarWinds Orion software.
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.
It has compromised the Able Desktop installer to gain access to victim's environments.
Technique:  Trusted Relationship
Once It gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.
It has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.
It has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.
It has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.
It has used legitimate access granted to Managed Service Providers in order to access victims of interest.
It has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.
It has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.
During the SolarWinds Compromise, It gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.
It has compromised third party service providers to gain access to victim's environments.
Technique:  Valid Accounts:Default Accounts
It has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.
HyperStack can use default credentials to connect to IPC$ shares on remote machines.
It enabled and used the default system managed account, DefaultAccount, via "powershell.exe" /c net user DefaultAccount /active:yes to connect to a targeted Exchange server over RDP.
Stuxnet infected WinCC machines via a hardcoded database server password.
Technique:  Valid Accounts:Domain Accounts
It leverages valid accounts after gaining credentials for use within the victim domain.
It has used compromised domain accounts to gain access to the target environment.
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.
CreepySnail can use stolen credentials to authenticate on target networks.
It has collected credentials from infected systems, including domain accounts.
It has used domain administrator accounts after dumping LSASS process memory.
It has used administrator credentials for lateral movement in compromised networks.
During Night Dragon, threat actors used domain accounts to gain further access to victim systems.
During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.
For Operation Ghost, It used stolen administrator credentials for lateral movement on compromised networks.
During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.
It has used stolen credentials to access administrative accounts within the domain.
If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.
During the SolarWinds Compromise, It used domain administrators' accounts to help facilitate lateral movement on compromised networks.
Stuxnet attempts to access network resources with a domain account’s credentials.
It has used stolen domain admin accounts to compromise additional hosts.
It actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.
It has used compromised domain accounts to authenticate to devices on compromised networks.
It has used administrative accounts, including Domain Admin, to move laterally within a victim network.
Technique:  Valid Accounts:Local Accounts
It has used legitimate local admin account credentials.
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.
Emotet can brute force a local admin password, then use it to facilitate lateral movement.
It has moved laterally using the Local Administrator account.
It has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.
It has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.
NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.
During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.
It has created admin accounts on a compromised host.
During the SolarWinds Compromise, It used compromised local accounts to access victims' networks.
It has used known administrator account credentials to execute the backdoor directly.
It has abused local accounts that have the same password across the victim’s network.
Umbreon creates valid local users to provide access to the system.
Technique:  Valid Accounts:Cloud Accounts
It has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.
It has gained access to a global administrator account in Azure AD and has used Service Principal credentials in Exchange.
It has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.
During C0027, It leveraged compromised credentials from victim users  to authenticate to Azure tenants.
It has used compromised credentials to sign into victims’ Microsoft 365 accounts.
It has used compromised credentials to access cloud assets within a target organization.
Pacu leverages valid cloud accounts to perform most of its operations.
Peirates can use stolen service account tokens to perform its operations.
ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.
During the SolarWinds Compromise, It used a compromised O365 administrator account to create a new Service Principal.
Technique:  Cloud Administration Command
AADInternals can execute commands on Azure virtual machines using the VM agent.
It has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.
Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.
Technique:  Command and Scripting Interpreter
It downloaded and launched code within a SCT file.
It has used COM scriptlets to download Cobalt Strike beacons.
It has used Ruby scripts to execute payloads.
It has utilized AutoIt and custom scripts to perform internal reconnaissance.
Bandook can support commands to execute Java-based payloads.
Bonadan can create bind and reverse shells on the infected system.
CHOPSTICK is capable of performing remote command execution.
DarkComet can execute various types of scripts on the victim’s machine.
Donut can generate shellcode outputs that execute via Ruby.
It has used the command line for execution.
Empire uses a command-line interface to interact with systems.
It scans processes on all victim systems in the environment and uses automated scripts to pull back the results.
It has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.
It used SQL scripts to help perform tasks on the victim's machine.
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.
It has used a Perl reverse shell to communicate with C2.
Get2 has the ability to run executables with command-line arguments.
gh0st RAT is able to open a remote shell to execute commands.
Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.
Malware used by It can run commands on the command-line interface.
Kessel can create a reverse shell between the infected host and a specified system.
Matryoshka is capable of providing Meterpreter shell access.
Melcoz has been distributed through an AutoIt loader script.
It has used various types of scripting for execution.
For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.
P.A.S. Webshell has the ability to create reverse shells with Perl scripts.
PoetRAT has executed a Lua script through a Lua interpreter for Windows.
SpeakUp uses Perl scripts.
It malware uses WMI to script data collection and command execution on the victim.
It has used a simple remote shell tool that will call back to the C2 server and wait for commands.
It has used a Perl script for information gathering.
WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.
Zeus Panda can launch remote scripts on the victim’s machine.
Technique:  Command and Scripting Interpreter:AppleScript
Bundlore can use AppleScript to inject malicious JavaScript into a browser.
Dok uses AppleScript to create a login item for persistence.
macOS.OSAMiner has used osascript to call itself via the do shell script command in the Launch Agent .plist file.
ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.