1. Home
  2. Techniques
  3. Enterprise
  4. 从本地系统获取数据

从本地系统获取数据

ID Name
T1005.001 内存驻留数据提取
T1005.002 合法系统工具链式调用
T1005.003 数据分片隐匿传输
T1005.004 时间延迟渐进式收集
T1005.005 文件属性伪装与元数据伪造

从本地系统获取数据是指攻击者通过访问目标系统的文件系统、数据库或配置存储，收集敏感信息以供后续攻击使用的技术。传统检测手段侧重于监控异常文件访问模式（如大量敏感目录遍历）、可疑进程创建事件（如非授权使用命令行工具）以及非常规数据操作行为（如批量注册表导出）。防御措施包括实施严格的进程白名单、监控命令行活动日志、部署文件完整性监控（FIM）系统等。

为规避传统检测机制，攻击者发展出多维度匿迹技术，通过存储介质规避、操作链伪装、传输特征稀释等手段，将数据窃取行为深度融入系统正常操作中。这些技术突破传统"读取-传输"的线性攻击模式，构建出分布式、低信噪比的持续数据泄露通道。

现有匿迹技术的共性在于重构数据生命周期各阶段的特征表达：在采集环节，通过内存操作和合法工具调用消除磁盘I/O特征；在存储环节，利用文件系统特性实现数据隐形存储；在传输环节，采用分片化和协议混淆技术隐藏泄露流量。具体而言，内存驻留技术将攻击平面从持久化存储转移至易失性内存，规避文件监控；工具链调用通过命令原子化分解突破进程行为分析；分片传输则利用协议合规性重构数据特征形态。这些技术共同形成"采集无痕、存储隐形、传输无形"的新型数据窃取范式。

匿迹技术的演进导致传统基于单点检测（如文件哈希匹配）或简单行为规则（如敏感路径访问告警）的防御体系失效。防御方需构建存储层元数据完整性校验、内存行为谱系分析、跨协议流重组等深度检测能力，并引入用户实体行为分析（UEBA）技术识别异常数据操作模式，实现对抗级数据防泄露防护。

ID: T1005
Sub-techniques:  T1005.001, T1005.002, T1005.003, T1005.004, T1005.005
ⓘ
Tactic: 信息收集
ⓘ
Platforms: Linux, Network, Windows, macOS
ⓘ
System Requirements: Privileges to access certain files and directories
Contributors: Austin Clark, @c2defense; William Cain
Version: 1.6
Created: 31 May 2017
Last Modified: 12 April 2023

匿迹效应

效应类型 是否存在
特征伪装 ✅
行为透明 ✅
数据遮蔽 ✅
时空释痕 ✅

特征伪装

攻击者通过滥用系统合法工具和伪造文件属性，使数据采集行为呈现为正常管理操作。例如将恶意命令嵌入PowerShell脚本的合法参数，或将被窃文件伪装成系统缓存文件，使得传统基于进程签名或文件扩展名的检测机制失效。

行为透明

内存驻留技术通过完全规避磁盘操作，使得依赖文件监控的防御体系无法感知数据采集行为。攻击者利用操作系统内核机制直接访问内存数据，不产生可追踪的I/O日志，实现"无痕"攻击。

数据遮蔽

采用内存加密和分片传输技术对敏感数据进行处理，使用TLS或自定义加密协议保护传输内容，使得网络层深度包检测（DPI）和终端数据泄露防护（DLP）系统难以解析有效载荷。

时空释痕

通过时间延迟策略将数据收集周期延长至数月，结合分片传输将单次数据量控制在检测阈值之下。这种长周期、低强度的攻击模式稀释了行为特征密度，使得基于短期行为分析的检测系统难以有效识别。

Procedure Examples

ID Name Description
S1028 Action RAT

Action RAT can collect local data from an infected machine.[1]
G1030 Agrius

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.[2]
S1025 Amadey

Amadey can collect information from a compromised host.[3]
G0138 Andariel

Andariel has collected large numbers of files from compromised network systems for later extraction.[4]
S0622 AppleSeed

AppleSeed can collect data on a compromised host.[5][6]
G0006 APT1

APT1 has collected files from a local victim.[7]
G0007 APT28

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.[8][9][10][11]
G0016 APT29

APT29 has stolen data from compromised hosts.[12]
G0022 APT3

APT3 will identify Microsoft Office documents on the victim's computer.[13]
G0067 APT37

APT37 has collected data from victims' local systems.[14]
G0082 APT38

APT38 has collected data from a compromised host.[15]
G0087 APT39

APT39 has used various tools to steal files from the compromised host.[16][17]
G0096 APT41

APT41 has uploaded files and data from a compromised host.[18]
G0143 Aquatic Panda

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.[19]
S1029 AuTo Stealer

AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.[1]
G0001 Axiom

Axiom has collected data from a compromised network.[20]
S0642 BADFLICK

BADFLICK has uploaded files from victims' machines.[21]
S0128 BADNEWS

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[22][23]
S0337 BadPatch

BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.[24]
S0234 Bandook

Bandook can collect local files from the system .[25]

S0239 Bankshot

Bankshot collects files from the local system.[26]
S0534 Bazar

Bazar can retrieve information from the infected machine.[27]
S0268 Bisonal

Bisonal has collected information from a compromised host.[28]

S0564 BlackMould

BlackMould can copy files on a compromised host.[29]
S0520 BLINDINGCAN

BLINDINGCAN has uploaded files from victim machines.[30]
S0651 BoxCaon

BoxCaon can upload files from a compromised host.[31]
G0060 BRONZE BUTLER

BRONZE BUTLER has exfiltrated files stolen from local systems.[32]
S1063 Brute Ratel C4

Brute Ratel C4 has the ability to upload files from a compromised system.[33]
S1039 Bumblebee

Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.[34]
C0015 C0015

During C0015, the threat actors obtained files and data from the compromised network.[35]
C0017 C0017

During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.[36]

C0026 C0026

During C0026, the threat actors collected documents from compromised hosts.[37]
S0274 Calisto

Calisto can collect data from user directories.[38]
S0572 Caterpillar WebShell

Caterpillar WebShell has a module to collect information from the local database.[39]

S1043 ccf32

ccf32 can collect files from a compromised host.[40]
S0674 CharmPower

CharmPower can collect data and files from a compromised host.[41]
S1149 CHIMNEYSWEEP

CHIMNEYSWEEP can collect files from compromised hosts.[42]
S0020 China Chopper

China Chopper's server component can upload local files.[43][44][45][46]
S0667 Chrommme

Chrommme can collect data from a local system.[47]
S0660 Clambling

Clambling can collect information from a compromised host.[48]
S0154 Cobalt Strike

Cobalt Strike can collect data from a local system.[49][50]
S0492 CookieMiner

CookieMiner has retrieved iPhone text messages from iTunes phone backup files.[51]
S0050 CosmicDuke

CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.[52]
C0004 CostaRicto

During CostaRicto, the threat actors collected data and files from compromised networks.[53]
S1023 CreepyDrive

CreepyDrive can upload files to C2 from victim machines.[54]
S0115 Crimson

Crimson can collect information from a compromised host.[55]
S0538 Crutch

Crutch can exfiltrate files from compromised systems.[56]
S0498 Cryptoistic

Cryptoistic can retrieve files from the local file system.[57]
G1012 CURIUM

CURIUM has exfiltrated data from a compromised machine.[58]
C0029 Cutting Edge

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.[59][60]
S0687 Cyclops Blink

Cyclops Blink can upload files from a compromised host.[61]
S1014 DanBot

DanBot can upload files from compromised hosts.[62]
G0070 Dark Caracal

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.[63]
S0673 DarkWatchman

DarkWatchman can collect files from a compromised host.[64]
S1021 DnsSystem

DnsSystem can upload files from infected machines after receiving a command with uploaddd in the string.[65]
G0035 Dragonfly

Dragonfly has collected data from local victim systems.[66]
S0694 DRATzarus

DRATzarus can collect information from a compromised host.[67]
S0502 Drovorub

Drovorub can transfer files from the victim machine.[68]
S0567 Dtrack

Dtrack can collect a variety of information from victim machines.[69]
S1159 DUSTTRAP

DUSTTRAP can gather data from infected systems.[70]
G1003 Ember Bear

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.[71][72]
S0634 EnvyScout

EnvyScout can collect sensitive NTLM material from a compromised host.[73]
S0404 esentutl

esentutl can be used to collect data from local file systems.[74]
S0512 FatDuke

FatDuke can copy files and directories from a compromised host.[75]
G1016 FIN13

FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.[76][77]
G0037 FIN6

FIN6 has collected and exfiltrated payment card data from compromised systems.[78][79][80]
G0046 FIN7

FIN7 has collected files and other sensitive information from a compromised network.[81]
S0696 Flagpro

Flagpro can collect data from a compromised host, including Windows authentication information.[82]
S0036 FLASHFLOOD

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.[83]
S0381 FlawedAmmyy

FlawedAmmyy has collected information and files from a compromised machine.[84]
S0661 FoggyWeb

FoggyWeb can retrieve configuration data from a compromised AD FS server.[85]
S0193 Forfiles

Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).[8]
G0117 Fox Kitten

Fox Kitten has searched local system resources to access sensitive documents.[86]
S0503 FrameworkPOS

FrameworkPOS can collect elements related to credit card data from process memory.[87]
C0001 Frankenstein

During Frankenstein, the threat actors used Empire to gather various local system information.[88]
S1044 FunnyDream

FunnyDream can upload files from victims' machines.[40][89]
G0093 GALLIUM

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.[90]
G0047 Gamaredon Group

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.[91]
S0666 Gelsemium

Gelsemium can collect data from a compromised host.[47]
S0477 Goopy

Goopy has the ability to exfiltrate documents from infected systems.[92]

S0237 GravityRAT

GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.[93]
S0690 Green Lambert

Green Lambert can collect data from a compromised host.[94]
S0632 GrimAgent

GrimAgent can collect data and files from a compromised host.[95]
G0125 HAFNIUM

HAFNIUM has collected data and files from a compromised machine.[46]
S0009 Hikit

Hikit can upload files from compromised machines.[20]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can read data from files.[96][97]
S1022 IceApple

IceApple can collect files, passwords, and other data from a compromised host.[98]
G0100 Inception

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.[99]
S0260 InvisiMole

InvisiMole can collect data from the system, and can monitor changes in specified directories.[100]
S1132 IPsec Helper

IPsec Helper can identify specific files and folders for follow-on exfiltration.[101]
S0015 Ixeshe

Ixeshe can collect data from a local system.[102]
S0265 Kazuar

Kazuar uploads files from a specified directory to the C2 server.[103]
G0004 Ke3chang

Ke3chang gathered information and files from local directories for exfiltration.[104][105]
S1020 Kevin

Kevin can upload logs and other data from a compromised host.[106]
S0526 KGH_SPY

KGH_SPY can send a file containing victim system information to C2.[107]
G0094 Kimsuky

Kimsuky has collected Office, PDF, and HWP documents from its victims.[108][109]
S0250 Koadic

Koadic can download files off the target system to send back to the server.[110][111]
S0356 KONNI

KONNI has stored collected information and discovered processes in a tmp file.[112]
S1075 KOPILUWAK

KOPILUWAK can gather information from compromised hosts.[37]
G1004 LAPSUS$

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.[113]
S1160 Latrodectus

Latrodectus can collect data from a compromised host using a stealer module.[114]
G0032 Lazarus Group

Lazarus Group has collected data and files from compromised networks.[115][116][117][118]
S0395 LightNeuron

LightNeuron can collect files from a local system.[119]
S0211 Linfo

Linfo creates a backdoor through which remote attackers can obtain data from local systems.[120]
S1101 LoFiSe

LoFiSe can collect files of interest from targeted systems.[121]
G1014 LuminousMoth

LuminousMoth has collected files and data from compromised machines.[122][123]
S0409 Machete

Machete searches the File system for files of interest.[124]

S1016 MacMa

MacMa can collect then exfiltrate files from the compromised system.[125]
S1060 Mafalda

Mafalda can collect files and information from a compromised host.[126]
G0059 Magic Hound

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.[127][128]
S0652 MarkiRAT

MarkiRAT can upload data from the victim's machine to the C2 server.[129]
S0500 MCMD

MCMD has the ability to upload files from an infected device.[130]
G0045 menuPass

menuPass has collected various files from the compromised computers.[131][132]
S1059 metaMain

metaMain can collect files and system information from a compromised host.[126][133]
S1146 MgBot

MgBot includes modules for collecting files from local systems based on a given set of properties and filenames.[134]
S1015 Milan

Milan can upload files from a compromised host.[135]
S0084 Mis-Type

Mis-Type has collected files and data from a compromised host.[136]
S0083 Misdat

Misdat has collected files and data from a compromised host.[136]
S0079 MobileOrder

MobileOrder exfiltrates data collected from the victim mobile device.[137]
S1026 Mongall

Mongall has the ability to upload files from victim's machines.[138]
S0630 Nebulae

Nebulae has the capability to upload collected files to C2.[139]
S0691 Neoichor

Neoichor can upload files from a victim's machine.[105]
C0002 Night Dragon

During Night Dragon, the threat actors collected files and other data from compromised systems.[140]
S1090 NightClub

NightClub can use a file monitor to steal specific files from targeted systems.[141]
S0385 njRAT

njRAT can collect data from a local system.[142]
S1131 NPPSPY

NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.[143]
S0340 Octopus

Octopus can exfiltrate files from the system using a documents collector tool.[144]
C0012 Operation CuckooBees

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.[145]
C0022 Operation Dream Job

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.[67][146]
C0006 Operation Honeybee

During Operation Honeybee, the threat actors collected data from compromised hosts.[147]
C0014 Operation Wocao

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.[148]
S0352 OSX_OCEANLOTUS.D

OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.[149]
S0594 Out1

Out1 can copy files and Registry data from compromised hosts.[150]
S1017 OutSteel

OutSteel can collect information from a compromised host.[151]
S0598 P.A.S. Webshell

P.A.S. Webshell has the ability to copy files on a compromised host.[152]
S0208 Pasam

Pasam creates a backdoor through which remote attackers can retrieve files.[153]
G0040 Patchwork

Patchwork collected and exfiltrated files from the infected system.[154]
S1102 Pcexter

Pcexter can upload files from targeted systems.[121]
S1050 PcShare

PcShare can collect files and information from a compromised host.[40]
S0517 Pillowmint

Pillowmint has collected credit card data using native API functions.[155]
S0048 PinchDuke

PinchDuke collects user files from the compromised host based on predefined file extensions.[156]
S1031 PingPull

PingPull can collect data from a compromised host.[157]
S0012 PoisonIvy

PoisonIvy creates a backdoor through which remote attackers can steal system information.[158]
S1012 PowerLess

PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.[159]
S0194 PowerSploit

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.[160][161]
S0223 POWERSTATS

POWERSTATS can upload files from compromised hosts.[162]
S0238 Proxysvc

Proxysvc searches the local system and gathers data.[163]
S0197 PUNCHTRACK

PUNCHTRACK scrapes memory for properly formatted payment card data.[164][165]
S0650 QakBot

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.[166][167]
S0262 QuasarRAT

QuasarRAT can retrieve files from compromised client machines.[168]
S0686 QuietSieve

QuietSieve can collect files from a compromised host.[169]
S1148 Raccoon Stealer

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.[170][171]
S0629 RainyDay

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.[139]
S0458 Ramsay

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.[172][173]

S1113 RAPIDPULSE

RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.[174]
S0169 RawPOS

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.[175][176][177]
S0662 RCSession

RCSession can collect data from a compromised host.[178][48]
G1039 RedCurl

RedCurl has collected data from the local disk of compromised hosts.[179][180]
S0448 Rising Sun

Rising Sun has collected data and files from a compromised host.[181]
S0240 ROKRAT

ROKRAT can collect host data and specific file types.[182][183][184]
S0090 Rover

Rover searches for files on local drives based on a predefined list of file extensions.[185]
S1018 Saint Bot

Saint Bot can collect files and information from a compromised host.[186]
S1099 Samurai

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.[187]
G0034 Sandworm Team

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.[188]
S1085 Sardonic

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.[189]

S0461 SDBbot

SDBbot has the ability to access the file system on a compromised host.[190]
S1019 Shark

Shark can upload files to its C2.[135][191]
S1089 SharpDisco

SharpDisco has dropped a recent-files stealer plugin to C:\Users\Public\WinSrcNT\It11.exe.[141]
S0444 ShimRat

ShimRat has the capability to upload collected files to a C2.[192]

S0610 SideTwist

SideTwist has the ability to upload files from a compromised host.[193]
S1110 SLIGHTPULSE

SLIGHTPULSE can read files specified on the local system.[194]
S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has uploaded files and information from victim machines.[195]
C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 extracted files from compromised networks.[196]
S0615 SombRAT

SombRAT has collected data and files from a compromised host.[53][197]
S0646 SpicyOmelette

SpicyOmelette has collected data and other information from a compromised host.[198]
S1037 STARWHALE

STARWHALE can collect data from an infected local host.[199]
G0038 Stealth Falcon

Stealth Falcon malware gathers data from the local victim system.[200]
S1034 StrifeWater

StrifeWater can collect data from a compromised host.[201]
S0559 SUNBURST

SUNBURST collected information from a compromised host.[202][203]
S1064 SVCReady

SVCReady can collect data from an infected host.[204]
S0663 SysUpdate

SysUpdate can collect information and files from a compromised host.[205]
S0011 Taidoor

Taidoor can upload data and files from a victim's machine.[206]
S0467 TajMahal

TajMahal has the ability to steal documents from the local system including the print spooler queue.[207]
G0027 Threat Group-3390

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[208]
S0665 ThreatNeedle

ThreatNeedle can collect data and files from a compromised host.[118]
S0668 TinyTurla

TinyTurla can upload files from a compromised host.[209]
G1022 ToddyCat

ToddyCat has run scripts to collect documents from targeted hosts.[121]
S0671 Tomiris

Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.[210]
S0266 TrickBot

TrickBot collects local files and information from the victim’s local machine.[211]
G0010 Turla

Turla RPC backdoors can upload files from victim machines.[212]
S0022 Uroburos

Uroburos can use its Get command to exfiltrate specified files from the compromised system.[213]
S0386 Ursnif

Ursnif has collected files from victim machines, including certificates and cookies.[214]
S0452 USBferry

USBferry can collect information from an air-gapped host machine.[215]

G1017 Volt Typhoon

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.[216][217][218]
S0670 WarzoneRAT

WarzoneRAT can collect data from a compromised host.[219]
S0515 WellMail

WellMail can exfiltrate files from the victim machine.[220]
S0514 WellMess

WellMess can send files from the victim machine to C2.[221][222]
S0645 Wevtutil

Wevtutil can be used to export events from a specific log.[223][224]
G0124 Windigo

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.[225]
G0102 Wizard Spider

Wizard Spider has collected data from a compromised host prior to exfiltration.[226]
S1065 Woody RAT

Woody RAT can collect information from a compromised host.[227]
S0653 xCaon

xCaon has uploaded files from victims' machines.[31]
S0658 XCSSET

XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.[228]
S0248 yty

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.[229]
S0672 Zox

Zox has the ability to upload files from a targeted system.[20]
S0412 ZxShell

ZxShell can transfer files from a compromised host.[230]
S1013 ZxxZ

ZxxZ can collect data from a compromised host.[231]

Mitigations

ID Mitigation Description
M1057 Data Loss Prevention

Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may search and collect local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

For network devices, monitor executed commands in AAA logs, especially those run by unexpected or unauthorized users.
DS0022 File File Access

Monitor for unexpected/abnormal access to files that may be malicious collection of local data, such as user files (pdf, .docx, .jpg, etc.) or local databases.
DS0009 Process OS API Execution

Monitor for API calls that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Process Creation

Monitor for newly executed processes that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
DS0012 Script Script Execution

Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.
  2. Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.
  3. Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.
  4. FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 12, 2024.
  5. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  6. KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.
  7. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  8. Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.
  9. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  10. Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.
  11. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
  12. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.
  13. valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.
  14. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  15. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  16. Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.
  17. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
  18. Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.
  19. CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.
  20. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
  21. Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.
  22. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
  23. Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.
  24. Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.
  25. Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
  26. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  27. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  28. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  29. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
  30. US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.
  31. CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
  32. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  33. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.
  34. Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.
  35. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  36. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.
  37. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
  38. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  39. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  40. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  41. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  42. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  43. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  44. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
  45. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  46. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.
  47. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  48. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  49. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  50. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  51. Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.
  52. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  53. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  54. Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.
  55. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.
  56. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
  57. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  58. MSTIC. (2021, November 16). Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021. Retrieved January 12, 2023.
  59. Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024.
  60. Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.
  61. NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
  62. SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19
  63. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  64. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  65. Shivtarkar, N. and Kumar, A. (2022, June 9). Lyceum .NET DNS Backdoor. Retrieved June 23, 2022.
  66. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  67. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  68. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
  69. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  70. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
  71. Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
  72. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.
  73. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
  74. Red Canary. (2021, March 31). 2021 Threat Detection Report. Retrieved August 31, 2021.
  75. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  76. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.
  77. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
  78. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
  79. Klijnsma, Y. (2018, September 11). Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims. Retrieved September 9, 2020.
  80. Klijnsma, Y. (2018, September 19). Another Victim of the Magecart Assault Emerges: Newegg. Retrieved September 9, 2020.
  81. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.
  82. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  83. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  84. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  85. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
  86. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
  87. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
  88. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  89. Global Research and Analysis Team. (2020, April 30). APT trends report Q1 2020. Retrieved September 19, 2022.
  90. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  91. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  92. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  93. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  94. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.
  95. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.
  96. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  97. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  98. CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.
  99. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  100. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  101. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
  102. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  103. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  104. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  105. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
  106. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  107. Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
  108. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
  109. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  110. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.
  111. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021.
  112. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
  113. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
  114. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.
  115. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  116. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  1. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.
  2. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.
  3. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
  4. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  5. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
  6. Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.
  7. Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.
  8. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  9. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
  10. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
  11. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.
  12. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
  13. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  14. Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
  15. United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.
  16. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
  17. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
  18. Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.
  19. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
  20. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
  21. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  22. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  23. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  24. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
  25. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.
  26. Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
  27. Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.
  28. Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.
  29. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  30. Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.
  31. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  32. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  33. Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.
  34. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.
  35. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
  36. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
  37. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  38. Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016.
  39. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  40. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  41. Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.
  42. Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
  43. Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.
  44. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  45. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  46. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  47. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  48. Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
  49. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  50. Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.
  51. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  52. CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.
  53. Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.
  54. S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.
  55. Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.
  56. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  57. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  58. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.
  59. Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
  60. TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
  61. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  62. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
  63. Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.
  64. Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.
  65. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  66. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  67. Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.
  68. Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.
  69. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.
  70. Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.
  71. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  72. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  73. Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.
  74. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  75. Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
  76. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  77. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  78. Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.
  79. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  80. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  81. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  82. CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.
  83. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.
  84. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  85. Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.
  86. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  87. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  88. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.
  89. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
  90. Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.
  91. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  92. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  93. Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.
  94. Kwiatkoswki, I. and Delcher, P. (2021, September 29). DarkHalo After SolarWinds: the Tomiris connection. Retrieved December 27, 2021.
  95. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  96. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  97. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  98. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  99. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  100. NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
  101. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
  102. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  103. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
  104. CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.
  105. PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
  106. CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.
  107. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
  108. F-Secure Labs. (2020, August 18). Lazarus Group Campaign Targeting the Cryptocurrency Vertical. Retrieved September 1, 2020.
  109. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  110. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.
  111. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.
  112. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
  113. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  114. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  115. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.