APT1

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.^[1][3]

The APT1 group is known to have used pass the hash.^[1]

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.^[1]

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.^[1]

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.^[1]

APT1 has used RAR to compress files before moving them outside of the victim network.^[1]

APT1 has been known to use credential dumping using Mimikatz.^[1]

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.^[1]

APT1 has registered hundreds of domains for use in operations.^[1]

APT1 used publicly available malware for privilege escalation.^[1]

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.^[1]

The APT1 group is known to have used RDP during operations.^[4]

APT1 has sent spearphishing emails containing malicious attachments.^[1]