Data from Local System
Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information. Adversaries may also use Automated Collection on the local system.
Procedure Examples |
|
| Name | Description |
|---|---|
| Frankenstein |
Frankenstein has enumerated hosts via Empire, gathering various local system information.(Citation: Talos Frankenstein June 2019) |
| Kimsuky |
Kimsuky has collected Office, PDF, and HWP documents from its victims.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021) |
| BRONZE BUTLER |
BRONZE BUTLER has exfiltrated files stolen from local systems.(Citation: Secureworks BRONZE BUTLER Oct 2017) |
| Proxysvc |
Proxysvc searches the local system and gathers data.(Citation: McAfee GhostSecret) |
| Drovorub |
Drovorub can transfer files from the victim machine.(Citation: NSA/FBI Drovorub August 2020) |
| Cryptoistic |
Cryptoistic can retrieve files from the local file system.(Citation: SentinelOne Lazarus macOS July 2020) |
| xCaon |
xCaon has uploaded files from victims' machines.(Citation: Checkpoint IndigoZebra July 2021) |
| LAPSUS$ |
LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.(Citation: MSTIC DEV-0537 Mar 2022) |
| APT39 |
APT39 has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020) |
| QakBot |
QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021) |
| ccf32 |
ccf32 can collect files from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020) |
| Dtrack |
Dtrack can collect a variety of information from victim machines.(Citation: CyberBit Dtrack) |
| Bankshot |
Bankshot collects files from the local system.(Citation: McAfee Bankshot) |
| BADNEWS |
When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018) |
| Rising Sun |
Rising Sun has collected data and files from a compromised host.(Citation: McAfee Sharpshooter December 2018) |
| PUNCHTRACK |
PUNCHTRACK scrapes memory for properly formatted payment card data.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016) |
| China Chopper |
China Chopper's server component can upload local files.(Citation: FireEye Periscope March 2018)(Citation: Lee 2013)(Citation: NCSC Joint Report Public Tools) |
| Axiom |
Axiom has collected data from a compromised network.(Citation: Novetta-Axiom) |
| Octopus |
Octopus can exfiltrate files from the system using a documents collector tool.(Citation: ESET Nomadic Octopus 2018) |
| FLASHFLOOD |
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.(Citation: FireEye APT30) |
| Operation Wocao |
Operation Wocao has exfiltrated files and directories of interest from the targeted system.(Citation: FoxIT Wocao December 2019) |
| P.A.S. Webshell |
P.A.S. Webshell has the ability to copy files on a compromised host.(Citation: ANSSI Sandworm January 2021) |
| Cobalt Strike |
Cobalt Strike can collect data from a local system.(Citation: Cobalt Strike TTPs Dec 2017)(Citation: Cobalt Strike Manual 4.3 November 2020) |
| Windigo |
Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018) |
| GrimAgent |
GrimAgent can collect data and files from a compromised host.(Citation: Group IB GrimAgent July 2021) |
| Nebulae |
Nebulae has the capability to upload collected files to C2.(Citation: Bitdefender Naikon April 2021) |
| KONNI |
KONNI has stored collected information and discovered processes in a tmp file.(Citation: Malwarebytes Konni Aug 2021) |
| WarzoneRAT |
WarzoneRAT can collect data from a compromised host.(Citation: Check Point Warzone Feb 2020) |
| PingPull |
PingPull can collect data from a compromised host.(Citation: Unit 42 PingPull Jun 2022) |
| PowerSploit |
PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation) |
|
During Night Dragon, the threat actors collected files and other data from compromised systems.(Citation: McAfee Night Dragon) |
|
| Fox Kitten |
Fox Kitten has searched local system resources to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020) |
| Caterpillar WebShell |
Caterpillar WebShell has a module to collect information from the local database.(Citation: ClearSky Lebanese Cedar Jan 2021) |
| Andariel |
Andariel has collected large numbers of files from compromised network systems for later extraction.(Citation: FSI Andariel Campaign Rifle July 2017) |
| Amadey |
Amadey can collect information from a compromised host.(Citation: BlackBerry Amadey 2020) |
| BLINDINGCAN |
BLINDINGCAN has uploaded files from victim machines.(Citation: US-CERT BLINDINGCAN Aug 2020) |
| APT1 |
APT1 has collected files from a local victim.(Citation: Mandiant APT1) |
| GALLIUM |
GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.(Citation: Cybereason Soft Cell June 2019) |
| SombRAT |
SombRAT has collected data and files from a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: CISA AR21-126A FIVEHANDS May 2021) |
| Lazarus Group |
Lazarus Group has collected data and files from compromised networks.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: ClearSky Lazarus Aug 2020)(Citation: McAfee Lazarus Jul 2020) |
| Ramsay |
Ramsay can collect Microsoft Word documents from the target's file system, as well as |
| MarkiRAT |
MarkiRAT can upload data from the victim's machine to the C2 server.(Citation: Kaspersky Ferocious Kitten Jun 2021) |
| Gamaredon Group |
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.(Citation: ESET Gamaredon June 2020) |
| OutSteel |
OutSteel can collect information from a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
| WellMess |
WellMess can send files from the victim machine to C2.(Citation: PWC WellMess July 2020)(Citation: CISA WellMess July 2020) |
| FIN6 |
FIN6 has collected and exfiltrated payment card data from compromised systems.(Citation: Trend Micro FIN6 October 2019)(Citation: RiskIQ British Airways September 2018)(Citation: RiskIQ Newegg September 2018) |
| yty |
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.(Citation: ASERT Donot March 2018) |
| Bumblebee |
Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.(Citation: Cybereason Bumblebee August 2022) |
| EnvyScout |
EnvyScout can collect sensitive NTLM material from a compromised host.(Citation: MSTIC Nobelium Toolset May 2021) |
| APT29 |
APT29 has extracted files from compromised networks.(Citation: Volexity SolarWinds) |
|
During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.(Citation: FoxIT Wocao December 2019) |
|
| Turla |
Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019) |
| Hydraq |
Hydraq creates a backdoor through which remote attackers can read data from files.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010) |
| SUNBURST |
SUNBURST collected information from a compromised host.(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: FireEye SUNBURST Backdoor December 2020) |
| FoggyWeb |
FoggyWeb can retrieve configuration data from a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021) |
| Cyclops Blink |
Cyclops Blink can upload files from a compromised host.(Citation: NCSC Cyclops Blink February 2022) |
| PowerLess |
PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.(Citation: Cybereason PowerLess February 2022) |
| APT41 |
APT41 has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021) |
| DRATzarus |
DRATzarus can collect information from a compromised host.(Citation: ClearSky Lazarus Aug 2020) |
|
During C0015, the threat actors obtained files and data from the compromised network.(Citation: DFIR Conti Bazar Nov 2021) |
|
| BlackMould |
BlackMould can copy files on a compromised host.(Citation: Microsoft GALLIUM December 2019) |
| MobileOrder |
MobileOrder exfiltrates data collected from the victim mobile device.(Citation: Scarlet Mimic Jan 2016) |
| ZxShell |
ZxShell can transfer files from a compromised host.(Citation: Talos ZxShell Oct 2014) |
| Bazar |
Bazar can retrieve information from the infected machine.(Citation: Cybereason Bazar July 2020) |
| SpicyOmelette |
SpicyOmelette has collected data and other information from a compromised host.(Citation: Secureworks GOLD KINGSWOOD September 2018) |
| DanBot |
DanBot can upload files from compromised hosts.(Citation: SecureWorks August 2019) |
| InvisiMole |
InvisiMole can collect data from the system, and can monitor changes in specified directories.(Citation: ESET InvisiMole June 2018) |
| Crimson |
Crimson can collect information from a compromised host.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022) |
| SLOTHFULMEDIA |
SLOTHFULMEDIA has uploaded files and information from victim machines.(Citation: CISA MAR SLOTHFULMEDIA October 2020) |
| AppleSeed |
AppleSeed can collect data on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi) |
| MacMa |
MacMa can collect then exfiltrate files from the compromised system.(Citation: ESET DazzleSpy Jan 2022) |
| APT37 |
APT37 has collected data from victims' local systems.(Citation: FireEye APT37 Feb 2018) |
| Flagpro |
Flagpro can collect data from a compromised host, including Windows authentication information.(Citation: NTT Security Flagpro new December 2021) |
| Taidoor |
Taidoor can upload data and files from a victim's machine.(Citation: TrendMicro Taidoor) |
| IceApple |
IceApple can collect files, passwords, and other data from a compromised host.(Citation: CrowdStrike IceApple May 2022) |
| Misdat |
Misdat has collected files and data from a compromised host.(Citation: Cylance Dust Storm) |
| Tomiris |
Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.(Citation: Kaspersky Tomiris Sep 2021) |
| Dragonfly |
Dragonfly has collected data from local victim systems.(Citation: US-CERT TA18-074A) |
| Shark |
Shark can upload files to its C2.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021) |
| XCSSET |
XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.(Citation: trendmicro xcsset xcode project 2020) |
| Dust Storm |
Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.(Citation: Cylance Dust Storm) |
| APT28 |
APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021) |
| BoxCaon |
BoxCaon can upload files from a compromised host.(Citation: Checkpoint IndigoZebra July 2021) |
| AuTo Stealer |
AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.(Citation: MalwareBytes SideCopy Dec 2021) |
| SDBbot |
SDBbot has the ability to access the file system on a compromised host.(Citation: Proofpoint TA505 October 2019) |
| QuasarRAT |
QuasarRAT can retrieve files from compromised client machines.(Citation: CISA AR18-352A Quasar RAT December 2018) |
| Ursnif |
Ursnif has collected files from victim machines, including certificates and cookies.(Citation: TrendMicro BKDR_URSNIF.SM) |
| Rover |
Rover searches for files on local drives based on a predefined list of file extensions.(Citation: Palo Alto Rover) |
| FrameworkPOS |
FrameworkPOS can collect elements related to credit card data from process memory.(Citation: SentinelOne FrameworkPOS September 2019) |
| Calisto |
Calisto can collect data from user directories.(Citation: Securelist Calisto July 2018) |
| TrickBot |
TrickBot collects local files and information from the victim’s local machine.(Citation: S2 Grupo TrickBot June 2017) |
| Bisonal |
Bisonal has collected information from a compromised host.(Citation: Talos Bisonal Mar 2020) |
| Inception |
Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.(Citation: Kaspersky Cloud Atlas August 2019) |
| PcShare |
PcShare can collect files and information from a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020) |
| Mongall |
Mongall has the ability to upload files from victim's machines.(Citation: SentinelOne Aoqin Dragon June 2022) |
| Ke3chang |
Ke3chang gathered information and files from local directories for exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021) |
| Patchwork |
Patchwork collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork) |
| ThreatNeedle |
ThreatNeedle can collect data and files from a compromised host.(Citation: Kaspersky ThreatNeedle Feb 2021) |
| APT3 |
APT3 will identify Microsoft Office documents on the victim's computer.(Citation: aptsim) |
| LightNeuron |
LightNeuron can collect files from a local system.(Citation: ESET LightNeuron May 2019) |
| RawPOS |
RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.(Citation: Kroll RawPOS Jan 2017)(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016) |
| DnsSystem |
DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.(Citation: Zscaler Lyceum DnsSystem June 2022) |
| Forfiles |
Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).(Citation: Überwachung APT28 Forfiles June 2015) |
| FatDuke |
FatDuke can copy files and directories from a compromised host.(Citation: ESET Dukes October 2019) |
| Dragonfly 2.0 |
Dragonfly 2.0 collected data from local victim systems.(Citation: US-CERT TA18-074A) |
| Kevin |
Kevin can upload logs and other data from a compromised host.(Citation: Kaspersky Lyceum October 2021) |
| Wevtutil |
Wevtutil can be used to export events from a specific log.(Citation: Wevtutil Microsoft Documentation)(Citation: F-Secure Lazarus Cryptocurrency Aug 2020) |
| POWERSTATS |
POWERSTATS can upload files from compromised hosts.(Citation: FireEye MuddyWater Mar 2018) |
| SideTwist |
SideTwist has the ability to upload files from a compromised host.(Citation: Check Point APT34 April 2021) |
| Green Lambert |
Green Lambert can collect data from a compromised host.(Citation: Objective See Green Lambert for OSX Oct 2021) |
| Neoichor |
Neoichor can upload files from a victim's machine.(Citation: Microsoft NICKEL December 2021) |
| Zox |
Zox has the ability to upload files from a targeted system.(Citation: Novetta-Axiom) |
| DarkWatchman |
DarkWatchman can collect files from a compromised host.(Citation: Prevailion DarkWatchman 2021) |
| Gelsemium |
Gelsemium can collect data from a compromised host.(Citation: ESET Gelsemium June 2021) |
| Milan |
Milan can upload files from a compromised host.(Citation: ClearSky Siamesekitten August 2021) |
|
During Operation Honeybee, the threat actors collected data from compromised hosts.(Citation: McAfee Honeybee) |
|
| BADFLICK |
BADFLICK has uploaded files from victims' machines.(Citation: Accenture MUDCARP March 2019) |
| CharmPower |
CharmPower can collect data and files from a compromised host.(Citation: Check Point APT35 CharmPower January 2022) |
| UNC2452 |
UNC2452 extracted files from compromised networks.(Citation: Volexity SolarWinds) |
| Mis-Type |
Mis-Type has collected files and data from a compromised host.(Citation: Cylance Dust Storm) |
| Out1 |
Out1 can copy files and Registry data from compromised hosts.(Citation: Trend Micro Muddy Water March 2021) |
| Threat Group-3390 |
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017) |
| CreepyDrive |
CreepyDrive can upload files to C2 from victim machines.(Citation: Microsoft POLONIUM June 2022) |
| GravityRAT |
GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.(Citation: Talos GravityRAT) |
| CookieMiner |
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.(Citation: Unit42 CookieMiner Jan 2019) |
| QuietSieve |
QuietSieve can collect files from a compromised host.(Citation: Microsoft Actinium February 2022) |
| USBferry |
USBferry can collect information from an air-gapped host machine.(Citation: TrendMicro Tropic Trooper May 2020) |
| TinyTurla |
TinyTurla can upload files from a compromised host.(Citation: Talos TinyTurla September 2021) |
| Machete |
Machete searches the File system for files of interest.(Citation: ESET Machete July 2019) |
|
During Frankenstein, the threat actors used Empire to gather various local system information.(Citation: Talos Frankenstein June 2019) |
|
| FIN7 |
FIN7 has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Carbon Spider August 2021) |
| Pillowmint |
Pillowmint has collected credit card data using native API functions.(Citation: Trustwave Pillowmint June 2020) |
| Goopy |
Goopy has the ability to exfiltrate documents from infected systems.(Citation: Cybereason Cobalt Kitty 2017) |
| PoisonIvy |
PoisonIvy creates a backdoor through which remote attackers can steal system information.(Citation: Symantec Darkmoon Aug 2005) |
| MCMD |
MCMD has the ability to upload files from an infected device.(Citation: Secureworks MCMD July 2019) |
|
During CostaRicto, the threat actors collected data and files from compromised networks.(Citation: BlackBerry CostaRicto November 2020) |
|
| RCSession |
RCSession can collect data from a compromised host.(Citation: Profero APT27 December 2020)(Citation: Trend Micro DRBControl February 2020) |
| FunnyDream |
FunnyDream can upload files from victims' machines.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: Kaspersky APT Trends Q1 2020) |
| Ixeshe |
Ixeshe can collect data from a local system.(Citation: Trend Micro IXESHE 2012) |
| OSX_OCEANLOTUS.D |
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.(Citation: Trend Micro MacOS Backdoor November 2020) |
| Crutch |
Crutch can exfiltrate files from compromised systems.(Citation: ESET Crutch December 2020) |
| Koadic |
Koadic can download files off the target system to send back to the server.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021) |
| Stealth Falcon |
Stealth Falcon malware gathers data from the local victim system.(Citation: Citizen Lab Stealth Falcon May 2016) |
| ROKRAT |
ROKRAT can collect host data and specific file types.(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021) |
| APT38 |
APT38 has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
| FlawedAmmyy |
FlawedAmmyy has collected information and files from a compromised machine.(Citation: Korean FSI TA505 2020) |
| Linfo |
Linfo creates a backdoor through which remote attackers can obtain data from local systems.(Citation: Symantec Linfo May 2012) |
| ShimRat |
ShimRat has the capability to upload collected files to a C2.(Citation: FOX-IT May 2016 Mofang) |
| PinchDuke |
PinchDuke collects user files from the compromised host based on predefined file extensions.(Citation: F-Secure The Dukes) |
| Chrommme |
Chrommme can collect data from a local system.(Citation: ESET Gelsemium June 2021) |
| CosmicDuke |
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.(Citation: F-Secure Cosmicduke) |
| BadPatch |
BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.(Citation: Unit 42 BadPatch Oct 2017) |
| esentutl |
esentutl can be used to collect data from local file systems.(Citation: Red Canary 2021 Threat Detection Report March 2021) |
| Hikit |
Hikit can upload files from compromised machines.(Citation: Novetta-Axiom) |
| ZxxZ |
ZxxZ can collect data from a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022) |
| menuPass |
menuPass has collected various files from the compromised computers.(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020) |
| Kazuar |
Kazuar uploads files from a specified directory to the C2 server.(Citation: Unit 42 Kazuar May 2017) |
| Pasam |
Pasam creates a backdoor through which remote attackers can retrieve files.(Citation: Symantec Pasam May 2012) |
| KGH_SPY |
KGH_SPY can send a file containing victim system information to C2.(Citation: Cybereason Kimsuky November 2020) |
| Magic Hound |
Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.(Citation: DFIR Report APT35 ProxyShell March 2022) |
| TajMahal |
TajMahal has the ability to steal documents from the local system including the print spooler queue.(Citation: Kaspersky TajMahal April 2019) |
|
During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.(Citation: Cybereason OperationCuckooBees May 2022) |
|
| Dark Caracal |
Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.(Citation: Lookout Dark Caracal Jan 2018) |
| STARWHALE |
STARWHALE can collect data from an infected local host.(Citation: DHS CISA AA22-055A MuddyWater February 2022) |
| Clambling |
Clambling can collect information from a compromised host.(Citation: Trend Micro DRBControl February 2020) |
| WellMail |
WellMail can exfiltrate files from the victim machine.(Citation: CISA WellMail July 2020) |
| RainyDay |
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.(Citation: Bitdefender Naikon April 2021) |
| Honeybee |
Honeybee collects data from the local victim system.(Citation: McAfee Honeybee) |
| StrifeWater |
StrifeWater can collect data from a compromised host.(Citation: Cybereason StrifeWater Feb 2022) |
| Cobalt Strike |
Cobalt Strike can collect data from a local system.(Citation: Cobalt Strike TTPs Dec 2017) |
| Bandook |
Bandook can collect local files from the system .(Citation: CheckPoint Bandook Nov 2020) |
| Sandworm Team |
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.(Citation: US District Court Indictment GRU Unit 74455 October 2020) |
| Action RAT |
Action RAT can collect local data from an infected machine.(Citation: MalwareBytes SideCopy Dec 2021) |
| njRAT |
njRAT can collect data from a local system.(Citation: Fidelis njRAT June 2013) |
| Saint Bot |
Saint Bot can collect files and information from a compromised host.(Citation: Malwarebytes Saint Bot April 2021) |
Mitigations |
|
| Mitigation | Description |
|---|---|
| Data from Local System Mitigation |
Identify unnecessary system utilities or potentially malicious software that may be used to collect data from the local system, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP) |
| Data Loss Prevention |
Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data.(Citation: PurpleSec Data Loss Prevention) |
Detection
Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, Network Device CLI commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.
References
- Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
- Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
- Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
- US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
- Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
- Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
- Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.
- Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.
- Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
- ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
- Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.
- Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
- Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
- Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.
- Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
- Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.
- MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
- Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.
- Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
- Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.
- MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
- Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
- Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.
- Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
- Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
- Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.
- MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
- KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022.
- Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
- Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
- F-Secure Labs. (2020, August 18). Lazarus Group Campaign Targeting the Cryptocurrency Vertical. Retrieved September 1, 2020.
- Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
- FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.
- Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.
- Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
- GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
- CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.
- PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
- DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
- CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
- Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
- Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
- TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
- Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
- Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
- Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.
- Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
- Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
- NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
- Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016.
- ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
- Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
- CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.
- Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.
- Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
- Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
- US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.
- ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
- Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.
- F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
- Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
- United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.
- Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
- Klijnsma, Y. (2018, September 19). Another Victim of the Magecart Assault Emerges: Newegg. Retrieved September 9, 2020.
- Klijnsma, Y. (2018, September 11). Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims. Retrieved September 9, 2020.
- Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
- Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
- DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
- FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
- Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
- NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
- Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.
- Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
- Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.
- Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
- Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
- Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.
- ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
- NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
- Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
- Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.
- Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
- Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
- An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
- Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
- Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
- FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
- Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.
- FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
- Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
- Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
- CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.
- Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
- Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
- Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
- DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
- F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
- Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.
- Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
- Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.
- Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.
- Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
- valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.
- Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
- GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
- Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
- CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
- Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.
- Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
- Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.
- Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
- Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
- Kizhakkinan, D. et al.. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
- Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
- Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
- M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
- Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
- Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
- Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
- Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
- Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
- Global Research and Analysis Team. (2020, April 30). APT trends report Q1 2020. Retrieved September 19, 2022.
- Kwiatkoswki, I. and Delcher, P. (2021, September 29). DarkHalo After SolarWinds: the Tomiris connection. Retrieved December 27, 2021.
- Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
- Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
- Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
- Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
- Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
- Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
- Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
- Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
- The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
- Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
- FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
- ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
- McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
- CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
- The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
- Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
- FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
- MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
- Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.
- Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
- Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
- Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
- Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.
- Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
- Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
- FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 29, 2021.
- SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19
- Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.
- Red Canary. (2021, March 31). 2021 Threat Detection Report. Retrieved August 31, 2021.
- Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
- Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021.
- Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
- PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
- PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
- MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
- Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.
- Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
- Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
- Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
- GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
- Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
- Shivtarkar, N. and Kumar, A. (2022, June 9). Lyceum .NET DNS Backdoor. Retrieved June 23, 2022.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
- Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.
- Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
- Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.
- Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.
- Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.
- Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
- Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.
- Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
- Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.
- Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
- Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
- Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
- N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.
- CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.
- Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
- Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
- Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
- DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.
- Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
- Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
- CISA. (2018, December 18). Analysis Report (AR18-352A) Quasar Open-Source Remote Administration Tool. Retrieved August 1, 2022.
- Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
- Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021.
Связанные риски
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.