Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Technique Process Discovery
CVE уязвимости
БДУ ФСТЭК уязвимости
НКЦКИ уязвимости
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
RU
Риски
Каталоги
MITRE ATT&CK
Техника
Process Discovery
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell. Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. On network devices, Network Device CLI commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)

ID: T1057
Tactic(s): Discovery
Platforms: Linux, macOS, Network, Windows
Data Sources: Command: Command Execution, Process: OS API Execution, Process: Process Creation
Version: 1.5
Created: 31 May 2017
Last Modified: 16 Apr 2024

Procedure Examples
Name Description
Epic

Epic uses the tasklist /v command to obtain a list of processes.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
WarzoneRAT

WarzoneRAT can obtain a list of processes on a compromised host.(Citation: Check Point Warzone Feb 2020)
FELIXROOT

FELIXROOT collects a list of running processes.(Citation: ESET GreyEnergy Oct 2018)

During Frankenstein, the threat actors used Empire to obtain a list of all running processes.(Citation: Talos Frankenstein June 2019)
Windshift

Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)
SUNSPOT

SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.(Citation: CrowdStrike SUNSPOT Implant January 2021)
StreamEx

StreamEx has the ability to enumerate processes.(Citation: Cylance Shell Crew Feb 2017)
Aria-body

Aria-body has the ability to enumerate loaded modules for a process.(Citation: CheckPoint Naikon May 2020).
Volt Typhoon

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
MoonWind

MoonWind has a command to return a list of running processes.(Citation: Palo Alto MoonWind March 2017)
Zebrocy

Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)
IronNetInjector

IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.(Citation: Unit 42 IronNetInjector February 2021 )
FruitFly

FruitFly has the ability to list processes on the system.(Citation: objsee mac malware 2017)
Cannon

Cannon can obtain a list of processes running on the system.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)
LoudMiner

LoudMiner used the ps command to monitor the running processes on the system.(Citation: ESET LoudMiner June 2019)

WinMM

WinMM sets a WH_CBT Windows hook to collect information on process creation.(Citation: Baumgartner Naikon 2015)
ZxxZ

ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Grandoreiro

Grandoreiro can identify installed security tools based on process names.(Citation: ESET Grandoreiro April 2020)
KEYMARBLE

KEYMARBLE can obtain a list of running processes on the system.(Citation: US-CERT KEYMARBLE Aug 2018)
WINERACK

WINERACK can enumerate processes.(Citation: FireEye APT37 Feb 2018)
NETEAGLE

NETEAGLE can send process listings over the C2 channel.(Citation: FireEye APT30)
Tropic Trooper

Tropic Trooper is capable of enumerating the running processes on the system using pslist.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)
SombRAT

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Ryuk

Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.(Citation: CrowdStrike Ryuk January 2019)
JHUHUGIT

JHUHUGIT obtains a list of running processes on the victim.(Citation: ESET Sednit Part 1)(Citation: Unit 42 Sofacy Feb 2018)
NKAbuse

NKAbuse will check victim systems to ensure only one copy of the malware is running.(Citation: NKAbuse SL)

During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)
Bisonal

Bisonal can obtain a list of running processes on the victim’s machine.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
ZIPLINE

ZIPLINE can identify running processes and their names.(Citation: Mandiant Cutting Edge January 2024)
Valak

Valak has the ability to enumerate running processes on a compromised host.(Citation: Cybereason Valak May 2020)
TSCookie

TSCookie has the ability to list processes on the infected host.(Citation: JPCert TSCookie March 2018)
PcShare

PcShare can obtain a list of running processes on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Ixeshe

Ixeshe can list running processes.(Citation: Trend Micro IXESHE 2012)
Bundlore

Bundlore has used the ps command to list processes.(Citation: MacKeeper Bundlore Apr 2019)
Sidewinder

Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)
SoreFang

SoreFang can enumerate processes on a victim machine through use of Tasklist.(Citation: CISA SoreFang July 2016)
Orz

Orz can gather a process list from the victim.(Citation: Proofpoint Leviathan Oct 2017)
Deep Panda

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.(Citation: Alperovitch 2014)
Latrodectus

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)
Lucifer

Lucifer can identify the process that owns remote connections.(Citation: Unit 42 Lucifer June 2020)
IPsec Helper

IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.(Citation: SentinelOne Agrius 2021)
Machete

Machete has a component to check for running processes to look for web browsers.(Citation: ESET Machete July 2019)

Apostle

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.(Citation: SentinelOne Agrius 2021)
JPIN

JPIN can list running processes.(Citation: Microsoft PLATINUM April 2016)
BADHATCH

BADHATCH can retrieve a list of running processes from a compromised machine.(Citation: BitDefender BADHATCH Mar 2021)

Nightdoor

Nightdoor can collect information on installed applications via Windows registry keys, as well as collecting information on running processes.(Citation: ESET EvasivePanda 2024)
SysUpdate

SysUpdate can collect information about running processes.(Citation: Lunghi Iron Tiger Linux)
RCSession

RCSession can identify processes based on PID.(Citation: Profero APT27 December 2020)
EKANS

EKANS looks for processes from a hard-coded list.(Citation: Dragos EKANS)(Citation: FireEye Ransomware Feb 2020)(Citation: IBM Ransomware Trends September 2020)
Cobalt Strike

Cobalt Strike's "beacon" payload can collect information on process details.(Citation: cobaltstrike manual)
BlackEnergy

BlackEnergy has gathered a process list by using Tasklist.exe.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)(Citation: ESET BlackEnergy Jan 2016)
Brave Prince

Brave Prince lists the running processes.(Citation: McAfee Gold Dragon)
Fysbis

Fysbis can collect information about running processes.(Citation: Fysbis Dr Web Analysis)

Remsec

Remsec can obtain a process list from the victim.(Citation: Kaspersky ProjectSauron Technical Analysis)
COATHANGER

COATHANGER will query running process information to determine subsequent program execution flow.(Citation: NCSC-NL COATHANGER Feb 2024)
Diavol

Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.(Citation: Fortinet Diavol July 2021)
Tasklist

Tasklist can be used to discover processes running on a system.(Citation: Microsoft Tasklist)
Caterpillar WebShell

Caterpillar WebShell can gather a list of processes running on the machine.(Citation: ClearSky Lebanese Cedar Jan 2021)

GeminiDuke

GeminiDuke collects information on running processes and environment variables from the victim.(Citation: F-Secure The Dukes)
Astaroth

Astaroth searches for different processes on the system.(Citation: Cybereason Astaroth Feb 2019)
APT29

APT29 has used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: CrowdStrike StellarParticle January 2022)
Woody RAT

Woody RAT can call `NtQuerySystemProcessInformation` with `SystemProcessInformation` to enumerate all running processes, including associated information such as PID, parent PID, image name, and owner.(Citation: MalwareBytes WoodyRAT Aug 2022)
Bankshot

Bankshot identifies processes and collects the process ids.(Citation: McAfee Bankshot)
APT1

APT1 gathered a list of running processes on the system using tasklist /v.(Citation: Mandiant APT1)
metaMain

metaMain can enumerate the processes that run on the platform.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Zeus Panda

Zeus Panda checks for running processes on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
Duqu

The discovery modules used with Duqu can collect information on process details.(Citation: Symantec W32.Duqu)
Comnie

Comnie uses the tasklist to view running processes on the victim’s machine.(Citation: Palo Alto Comnie)
Operation Wocao

Operation Wocao has collected a list of running processes on the infected system.(Citation: FoxIT Wocao December 2019)
Dacls

Dacls can collect data on running and parent processes.(Citation: TrendMicro macOS Dacls May 2020)
POWRUNER

POWRUNER may collect process information by running tasklist on a victim.(Citation: FireEye APT34 Dec 2017)
TAINTEDSCRIBE

TAINTEDSCRIBE can execute ProcessList for process discovery.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Ursnif

Ursnif has gathered information about running processes.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)
Agent Tesla

Agent Tesla can list the current running processes on the system.(Citation: Fortinet Agent Tesla June 2017)
Final1stspy

Final1stspy obtains a list of running processes.(Citation: Unit 42 Nokki Oct 2018)
Sykipot

Sykipot may gather a list of running processes by running tasklist /v.(Citation: AlienVault Sykipot 2011)
Imminent Monitor

Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.(Citation: Imminent Unit42 Dec2019)
PowerShower

PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.(Citation: Kaspersky Cloud Atlas August 2019)
HAFNIUM

HAFNIUM has used `tasklist` to enumerate processes.(Citation: Rapid7 HAFNIUM Mar 2021)
Darkhotel

Darkhotel malware can collect a list of running processes on a system.(Citation: Securelist Darkhotel Aug 2015)

Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.(Citation: Lumen KVBotnet 2023)
Elise

Elise enumerates processes via the tasklist command.(Citation: Accenture Dragonfish Jan 2018)
AppleSeed

AppleSeed can enumerate the current process on a compromised host.(Citation: Malwarebytes Kimsuky June 2021)
Avenger

Avenger has the ability to use Tasklist to identify running processes.(Citation: Trend Micro Tick November 2019)
Play

Play has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
PlugX

PlugX has a module to list the processes running on a machine.(Citation: CIRCL PlugX March 2013)
DUSTTRAP

DUSTTRAP can enumerate running processes.(Citation: Google Cloud APT41 2024)
Seasalt

Seasalt has a command to perform a process listing.(Citation: Mandiant APT1 Appendix)
Kasidet

Kasidet has the ability to search for a given process name in processes currently running in the system.(Citation: Zscaler Kasidet)
Stealth Falcon

Stealth Falcon malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)
TeamTNT

TeamTNT has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT) TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)
Javali

Javali can monitor processes for open browsers and custom banking applications.(Citation: Securelist Brazilian Banking Malware July 2020)
Trojan.Karagany

Trojan.Karagany can use Tasklist to collect a list of running tasks.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
APT28

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.(Citation: Unit 42 Playbook Dec 2017)
ROKRAT

ROKRAT can list the current running processes on the system.(Citation: Talos ROKRAT)(Citation: NCCGroup RokRat Nov 2018)
Pasam

Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.(Citation: Symantec Pasam May 2012)
BabyShark

BabyShark has executed the tasklist command.(Citation: Unit42 BabyShark Feb 2019)

GravityRAT

GravityRAT lists the running processes on the system.(Citation: Talos GravityRAT)
Winnti for Windows

Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.(Citation: Novetta Winnti April 2015)
iKitten

iKitten lists the current processes running.(Citation: objsee mac malware 2017)
P8RAT

P8RAT can check for specific processes associated with virtual environments.(Citation: Securelist APT10 March 2021)
down_new

down_new has the ability to list running processes on a compromised host.(Citation: Trend Micro Tick November 2019)
Chimera

Chimera has used tasklist to enumerate processes.(Citation: NCC Group Chimera January 2021)
Brute Ratel C4

Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).(Citation: Palo Alto Brute Ratel July 2022)
Donut

Donut includes subprojects that enumerate and identify information about Process Injection candidates.(Citation: Donut Github)

Cuckoo Stealer

Cuckoo Stealer can use `ps aux` to enumerate running processes.(Citation: Kandji Cuckoo April 2024)
BLACKCOFFEE

BLACKCOFFEE has the capability to discover processes.(Citation: FireEye APT17)

During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.(Citation: DFIR Conti Bazar Nov 2021)
Avaddon

Avaddon has collected information about running processes.(Citation: Arxiv Avaddon Feb 2021)
Helminth

Helminth has used Tasklist to get information on processes.(Citation: Unit 42 Playbook Dec 2017)
yty

yty gets an output of running processes using the tasklist command.(Citation: ASERT Donot March 2018)
Gelsemium

Gelsemium can enumerate running processes.(Citation: ESET Gelsemium June 2021)
Kazuar

Kazuar obtains a list of running processes through WMI querying and the ps command.(Citation: Unit 42 Kazuar May 2017)
FunnyDream

FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.(Citation: Bitdefender FunnyDream Campaign November 2020)
Get2

Get2 has the ability to identify running processes on an infected host.(Citation: Proofpoint TA505 October 2019)
HALFBAKED

HALFBAKED can obtain information about running processes on the victim.(Citation: FireEye FIN7 April 2017)
PowerDuke

PowerDuke has a command to list the victim's processes.(Citation: Volexity PowerDuke November 2016)
KOPILUWAK

KOPILUWAK can enumerate current running processes on the targeted machine.(Citation: Mandiant Suspected Turla Campaign February 2023)
Andariel

Andariel has used tasklist to enumerate processes and find a specific string.(Citation: Kaspersky Andariel Ransomware June 2021)
BACKSPACE

BACKSPACE may collect information about running processes.(Citation: FireEye APT30)
LookBack

LookBack can list running processes.(Citation: Proofpoint LookBack Malware Aug 2019)
ADVSTORESHELL

ADVSTORESHELL can list running processes.(Citation: ESET Sednit Part 2)
RainyDay

RainyDay can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
ZxShell

ZxShell has a command, ps, to obtain a listing of processes on the system.(Citation: Talos ZxShell Oct 2014)

Lazarus Group

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)
Mafalda

Mafalda can enumerate running processes on a machine.(Citation: SentinelLabs Metador Sept 2022)
Carbanak

Carbanak lists running processes.(Citation: FireEye CARBANAK June 2017)
QakBot

QakBot has the ability to check running processes.(Citation: ATT QakBot April 2021)
FoggyWeb

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.(Citation: MSTIC FoggyWeb September 2021)
Bazar

Bazar can identity the current process on a compromised host.(Citation: Cybereason Bazar July 2020)
Molerats

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)
Nebulae

Nebulae can enumerate processes on a target system.(Citation: Bitdefender Naikon April 2021)
Earth Lusca

Earth Lusca has used Tasklist to obtain information from a compromised host.(Citation: TrendMicro EarthLusca 2022)
MobileOrder

MobileOrder has a command to upload information about all running processes to its C2 server.(Citation: Scarlet Mimic Jan 2016)
NETWIRE

NETWIRE can discover processes on compromised hosts.(Citation: FireEye NETWIRE March 2019)
Bad Rabbit

Bad Rabbit can enumerate all running processes to compare hashes.(Citation: Secure List Bad Rabbit)
4H RAT

4H RAT has the capability to obtain a listing of running processes (including loaded modules).(Citation: CrowdStrike Putter Panda)
KONNI

KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
FatDuke

FatDuke can list running processes on the localhost.(Citation: ESET Dukes October 2019)
Heyoka Backdoor

Heyoka Backdoor can gather process information.(Citation: SentinelOne Aoqin Dragon June 2022)
KillDisk

KillDisk has called GetCurrentProcess.(Citation: Trend Micro KillDisk 2)
ELMER

ELMER is capable of performing process listings.(Citation: FireEye EPS Awakens Part 2)
PowerStallion

PowerStallion has been used to monitor process lists.(Citation: ESET Turla PowerShell May 2019)
Raspberry Robin

Raspberry Robin can identify processes running on the victim machine, such as security software, during execution.(Citation: TrendMicro RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024)
Pandora

Pandora can monitor processes on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)
jRAT

jRAT can query and kill system processes.(Citation: Symantec Frutas Feb 2013)
DarkComet

DarkComet can list active processes running on the victim’s machine.(Citation: Malwarebytes DarkComet March 2018)
TajMahal

TajMahal has the ability to identify running processes and associated plugins on an infected host.(Citation: Kaspersky TajMahal April 2019)
Clop

Clop can enumerate all processes on the victim's machine.(Citation: Mcafee Clop Aug 2019)
DarkTortilla

DarkTortilla can enumerate a list of running processes on a compromised system.(Citation: Secureworks DarkTortilla Aug 2022)
Volgmer

Volgmer can gather a list of processes.(Citation: Symantec Volgmer Aug 2014)
Gold Dragon

Gold Dragon checks the running processes on the victim’s machine.(Citation: McAfee Gold Dragon)
Industroyer2

Industroyer2 has the ability to cyclically enumerate running processes such as PServiceControl.exe, PService_PDD.exe, and other targets supplied through a hardcoded configuration.(Citation: Industroyer2 Mandiant April 2022)
Crimson

Crimson contains a command to list processes.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)

RATANKBA

RATANKBA lists the system’s processes.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)
Mustang Panda

Mustang Panda has used tasklist /v to determine active process information.(Citation: Avira Mustang Panda January 2020)

CHIMNEYSWEEP

CHIMNEYSWEEP can check if a process name contains “creensaver.”(Citation: Mandiant ROADSWEEP August 2022)
Pillowmint

Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.(Citation: Trustwave Pillowmint June 2020)

Rising Sun

Rising Sun can enumerate all running processes and process information on an infected machine.(Citation: McAfee Sharpshooter December 2018)

Cyclops Blink

Cyclops Blink can enumerate the process it is currently running under.(Citation: NCSC Cyclops Blink February 2022)
DarkGate

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.(Citation: Ensilo Darkgate 2018)

Skidmap

Skidmap has monitored critical processes to ensure resiliency.(Citation: Trend Micro Skidmap)

Ramsay

Ramsay can gather a list of running processes by using Tasklist.(Citation: Antiy CERT Ramsay April 2020)
ToddyCat

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.(Citation: Kaspersky ToddyCat Check Logs October 2023)
LunarWeb

LunarWeb has used shell commands to list running processes.(Citation: ESET Turla Lunar toolset May 2024)
PipeMon

PipeMon can iterate over the running processes to find a suitable injection target.(Citation: ESET PipeMon May 2020)
MacMa

MacMa can enumerate running processes.(Citation: ESET DazzleSpy Jan 2022)
Frankenstein

Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.(Citation: Talos Frankenstein June 2019)
PLAINTEE

PLAINTEE performs the tasklist command to list running processes.(Citation: Rancor Unit42 June 2018)
Linfo

Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.(Citation: Symantec Linfo May 2012)
ShadowPad

ShadowPad has collected the PID of a malicious process.(Citation: Kaspersky ShadowPad Aug 2017)
BISCUIT

BISCUIT has a command to enumerate running processes and identify their owners.(Citation: Mandiant APT1 Appendix)
Mosquito

Mosquito runs tasklist to obtain running processes.(Citation: ESET Turla Mosquito Jan 2018)
SUNBURST

SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.(Citation: FireEye SUNBURST Backdoor December 2020)
Komplex

The OsInfo function in Komplex collects a running process list.(Citation: Sofacy Komplex Trojan)
TrickBot

TrickBot uses module networkDll for process list discovery.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)
APT5

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe. (Citation: Mandiant Pulse Secure Update May 2021)

During FunnyDream, the threat actors used Tasklist on targeted systems.(Citation: Bitdefender FunnyDream Campaign November 2020)
BLUELIGHT

BLUELIGHT can collect process filenames and SID authority level.(Citation: Volexity InkySquid BLUELIGHT August 2021)
Turla

Turla surveys a system upon check-in to discover running processes using the tasklist /v command.(Citation: Kaspersky Turla) Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)
MuddyWater

MuddyWater has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)
OceanSalt

OceanSalt can collect the name and ID for every process running on the system.(Citation: McAfee Oceansalt Oct 2018)
Rocke

Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)

Magic Hound

Magic Hound malware can list running processes.(Citation: Unit 42 Magic Hound Feb 2017)
gh0st RAT

gh0st RAT has the capability to list processes.(Citation: FireEye Hacking Team)
Sardonic

Sardonic has the ability to execute the `tasklist` command.(Citation: Bitdefender Sardonic Aug 2021)
HotCroissant

HotCroissant has the ability to list running processes on the infected host.(Citation: Carbon Black HotCroissant April 2020)
CharmPower

CharmPower has the ability to list running processes through the use of `tasklist`.(Citation: Check Point APT35 CharmPower January 2022)
Hydraq

Hydraq creates a backdoor through which remote attackers can monitor processes.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
HELLOKITTY

HELLOKITTY can search for specific processes to terminate.(Citation: FireEye FiveHands April 2021)
APT37

APT37's Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123)
PoetRAT

PoetRAT has the ability to list all running processes.(Citation: Talos PoetRAT April 2020)
DRATzarus

DRATzarus can enumerate and examine running processes to determine if a debugger is present.(Citation: ClearSky Lazarus Aug 2020)
Zox

Zox has the ability to list processes.(Citation: Novetta-Axiom)
Mispadu

Mispadu can enumerate the running processes on a compromised host.(Citation: ESET Security Mispadu Facebook Ads 2019)
MarkiRAT

MarkiRAT can search for different processes on a system.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Goopy

Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.(Citation: Cybereason Cobalt Kitty 2017)
Clambling

Clambling can enumerate processes on a targeted system.(Citation: Trend Micro DRBControl February 2020)
MgBot

MgBot includes a module for establishing a process watchdog for itself, identifying if the MgBot process is still running.(Citation: Symantec Daggerfly 2023)
SYSCON

SYSCON has the ability to use Tasklist to list running processes.(Citation: Unit 42 CARROTBAT January 2020)
Backdoor.Oldrea

Backdoor.Oldrea collects information about running processes.(Citation: Symantec Dragonfly)
FrameworkPOS

FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.(Citation: SentinelOne FrameworkPOS September 2019)
BBSRAT

BBSRAT can list running processes.(Citation: Palo Alto Networks BBSRAT)
NavRAT

NavRAT uses tasklist /v to check running processes.(Citation: Talos NavRAT May 2018)
Kimsuky

Kimsuky can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021)
XAgentOSX

XAgentOSX contains the getProcessList function to run ps aux to get running processes.(Citation: XAgentOSX 2017)
Saint Bot

Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Dtrack

Dtrack’s dropper can list all running processes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
Ninja

Ninja can enumerate processes on a targeted host.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
USBferry

USBferry can use tasklist to gather information about the process running on the infected system.(Citation: TrendMicro Tropic Trooper May 2020)

SocGholish

SocGholish can list processes on targeted hosts.(Citation: Secureworks Gold Prelude Profile)
Kwampirs

Kwampirs collects a list of running services with the command tasklist /v.(Citation: Symantec Orangeworm April 2018)
Bumblebee

Bumblebee can identify processes associated with analytical tools.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)(Citation: Medium Ali Salem Bumblebee April 2022)
PowerSploit

PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Cuba

Cuba can enumerate processes running on a victim's machine.(Citation: McAfee Cuba April 2021)
RogueRobin

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.(Citation: Unit 42 DarkHydrus July 2018)
Proxysvc

Proxysvc lists processes running on the system.(Citation: McAfee GhostSecret)
NightClub

NightClub has the ability to use `GetWindowThreadProcessId` to identify the process behind a specified window.(Citation: MoustachedBouncer ESET August 2023)
Maze

Maze has gathered all of the running system processes.(Citation: McAfee Maze March 2020)

ObliqueRAT

ObliqueRAT can check for blocklisted process names on a compromised host.(Citation: Talos Oblique RAT March 2021)
SVCReady

SVCReady can collect a list of running processes from an infected host.(Citation: HP SVCReady Jun 2022)
Higaisa

Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)
Poseidon Group

After compromising a victim, Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)
Ke3chang

Ke3chang performs process discovery using tasklist commands.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)
ThiefQuest

ThiefQuest obtains a list of running processes using the function kill_unwanted.(Citation: wardle evilquest parti)
SHOTPUT

SHOTPUT has a command to obtain a process listing.(Citation: Palo Alto CVE-2015-3113 July 2015)
SodaMaster

SodaMaster can search a list of running processes.(Citation: Securelist APT10 March 2021)
Honeybee

Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.(Citation: McAfee Honeybee)
HEXANE

HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)
SLOTHFULMEDIA

SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.(Citation: CISA MAR SLOTHFULMEDIA October 2020)

Babuk

Babuk has the ability to check running processes on a targeted system.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)
Inception

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)
Taidoor

Taidoor can use GetCurrentProcessId for process discovery.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
SDBbot

SDBbot can enumerate a list of running processes on a compromised machine.(Citation: Korean FSI TA505 2020)
POORAIM

POORAIM can enumerate processes.(Citation: FireEye APT37 Feb 2018)
Akira

Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.(Citation: Kersten Akira 2023)
njRAT

njRAT can search a list of running processes for Tr.exe.(Citation: Trend Micro njRAT 2018)
AsyncRAT

AsyncRAT can examine running processes to determine if a debugger is present.(Citation: Telefonica Snip3 December 2021)
FinFisher

FinFisher checks its parent process for indications that it is running in a sandbox setup.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
OilRig

OilRig has run tasklist on a victim's machine.(Citation: Palo Alto OilRig May 2016)
Waterbear

Waterbear can identify the process for a specific security product.(Citation: Trend Micro Waterbear December 2019)
SynAck

SynAck enumerates all running processes.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
APT3

APT3 has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)
RotaJakiro

RotaJakiro can monitor the `/proc/[PID]` directory of known RotaJakiro processes as a part of its persistence when executing with non-root permissions. If the process is found dead, it resurrects the process. RotaJakiro processes can be matched to an associated Advisory Lock, in the `/proc/locks` folder, to ensure it doesn't spawn more than one process.(Citation: RotaJakiro 2021 netlab360 analysis)
Uroburos

Uroburos can use its `Process List` command to enumerate processes on compromised hosts.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
PLEAD

PLEAD has the ability to list processes on the compromised host.(Citation: TrendMicro BlackTech June 2017)
StrongPity

StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.(Citation: Talos Promethium June 2020)
Kinsing

Kinsing has used ps to list processes.(Citation: Aqua Kinsing April 2020)
Gamaredon Group

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)
SILENTTRINITY

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.(Citation: GitHub SILENTTRINITY Modules July 2019)

During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.(Citation: McAfee Honeybee)
EvilBunny

EvilBunny has used EnumProcesses() to identify how many process are running in the environment.(Citation: Cyphort EvilBunny Dec 2014)
UBoatRAT

UBoatRAT can list running processes on the system.(Citation: PaloAlto UBoatRAT Nov 2017)
Emotet

Emotet has been observed enumerating local processes.(Citation: ASEC Emotet 2017)

During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.(Citation: Cybereason OperationCuckooBees May 2022)
Carbon

Carbon can list the processes on the victim’s machine.(Citation: ESET Carbon Mar 2017)
ChChes

ChChes collects its process identifier (PID) on the victim.(Citation: Palo Alto menuPass Feb 2017)
OutSteel

OutSteel can identify running processes on a compromised host.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Winnti Group

Winnti Group looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)
Lizar

Lizar has a plugin designed to obtain a list of processes.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
Metamorfo

Metamorfo has performed process name checks and has monitored applications.(Citation: Medium Metamorfo Apr 2020)

Conti

Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.(Citation: CarbonBlack Conti July 2020)
InvisiMole

InvisiMole can obtain a list of running processes.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Socksbot

Socksbot can list all running processes.(Citation: TrendMicro Patchwork Dec 2017)
Cobalt Strike

Cobalt Strike's Beacon payload can collect information on process details.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)
Cardinal RAT

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.(Citation: PaloAlto CardinalRat Apr 2017)
Empire

Empire can find information about processes running on local and remote systems.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)
CaddyWiper

CaddyWiper can obtain a list of current processes.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Derusbi

Derusbi collects current and parent process IDs.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
Meteor

Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.(Citation: Check Point Meteor Aug 2021)
Royal

Royal can use `GetCurrentProcess` to enumerate processes.(Citation: Cybereason Royal December 2022)
RTM

RTM can obtain information about process integrity levels.(Citation: ESET RTM Feb 2017)
Flagpro

Flagpro has been used to run the tasklist command on a compromised system.(Citation: NTT Security Flagpro new December 2021)
macOS.OSAMiner

macOS.OSAMiner has used `ps ax | grep | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.(Citation: SentinelLabs reversing run-only applescripts 2021)
INC Ransomware

INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.(Citation: Cybereason INC Ransomware November 2023)
DustySky

DustySky collects information about running processes from victims.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)
APT38

APT38 leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018)
Azorult

Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)
Bonadan

Bonadan can use the ps command to discover other cryptocurrency miners active on the system.(Citation: ESET ForSSHe December 2018)
VERMIN

VERMIN can get a list of the processes and running tasks on the system.(Citation: Unit 42 VERMIN Jan 2018)
ShimRatReporter

ShimRatReporter listed all running processes on the machine.(Citation: FOX-IT May 2016 Mofang)
UNC2452

UNC2452 used multiple command-line utilities to enumerate running processes.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)
Carberp

Carberp has collected a list of running processes.(Citation: Trusteer Carberp October 2010)
AvosLocker

AvosLocker has discovered system processes by calling `RmGetList`.(Citation: Malwarebytes AvosLocker Jul 2021)
Pupy

Pupy can list the running processes and get the process ID and parent process’s ID.(Citation: GitHub Pupy)
Doki

Doki has searched for the current process’s PID.(Citation: Intezer Doki July 20)

During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.(Citation: FoxIT Wocao December 2019)
POWERSTATS

POWERSTATS has used get_tasklist to discover processes on the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)

Mitigations
Mitigation Description
Process Discovery Mitigation

Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. For network infrastructure devices, collect AAA logging to monitor for `show` commands being run by non-standard users from non-standard locations.

References

  1. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  2. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  3. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  4. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  5. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  6. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  7. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  8. US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
  9. Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.
  10. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  11. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  12. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
  13. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  14. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  15. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  16. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  17. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  18. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.
  19. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
  20. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  21. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  22. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.
  23. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  24. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.
  25. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  26. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  27. Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.
  28. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  29. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  30. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  31. Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.
  32. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  33. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  34. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  35. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  36. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  37. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  38. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  39. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
  40. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  41. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  42. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  43. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  44. KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.
  45. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  46. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.
  47. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  48. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.
  49. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.
  50. Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.
  51. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  52. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  53. Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.
  54. Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.
  55. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
  56. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  57. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  58. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.
  59. Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.
  60. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.
  61. Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.
  62. Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
  63. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  64. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  65. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.
  66. Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.
  67. Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
  68. Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
  69. Singleton, C. and Kiefer, C. (2020, September 28). Ransomware 2020: Attack Trends Affecting Organizations Worldwide. Retrieved September 20, 2021.
  70. Zafra, D., et al. (2020, February 24). Ransomware Against the Machine: How Adversaries are Learning to Disrupt Industrial Production by Targeting IT and OT. Retrieved March 2, 2021.
  71. Dragos. (2020, February 3). EKANS Ransomware and ICS Operations. Retrieved February 9, 2021.
  72. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry . Retrieved June 10, 2020.
  73. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  74. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  75. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  76. Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
  77. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  78. Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.
  79. Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.
  80. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  81. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  82. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  83. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  84. MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.
  85. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  86. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  87. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
  88. Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.
  89. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  90. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  91. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  92. Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.
  93. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  94. USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.
  95. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  96. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  97. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  98. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
  99. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  100. Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.
  101. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  102. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.
  103. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  104. Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.
  105. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  106. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  107. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  108. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
  109. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  110. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
  111. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  112. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  113. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  114. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
  115. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  116. GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.
  117. Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.
  118. Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  119. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  120. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  121. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  122. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  123. Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.
  124. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  125. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
  126. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
  127. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  128. Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.
  129. TheWover. (2019, May 9). donut. Retrieved March 25, 2022.
  130. Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.
  131. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  132. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  133. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.
  134. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  135. Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.
  136. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  137. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  138. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  139. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  140. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.
  141. Park, S. (2021, June 15). Andariel evolves to target South Korea with ransomware. Retrieved September 29, 2021.
  142. Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.
  143. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  144. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  145. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  146. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  147. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  148. Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.
  149. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  150. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  151. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  152. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
  153. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
  154. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  155. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  156. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  157. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  158. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.
  159. Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021.
  160. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  161. Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.
  162. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.
  163. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  164. Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.
  165. Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.
  166. Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  167. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  168. Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.
  169. Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.
  170. Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
  171. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.
  172. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  173. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  174. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
  175. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  176. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  177. Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.
  178. N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.
  179. Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  180. Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.
  181. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  182. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  183. Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.
  184. Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
  185. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  186. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  187. NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.
  188. Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.
  189. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.
  190. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  191. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
  192. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.
  193. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  194. M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
  195. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  196. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  197. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.
  198. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  199. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  200. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  201. Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.
  202. Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.
  203. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.
  204. Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.
  205. ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020.
  206. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
  207. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  208. Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.
  209. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  210. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  211. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  212. Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.
  213. Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.
  214. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  215. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  216. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  217. Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
  218. ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.
  219. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
  220. ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.
  221. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  222. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  223. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  224. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
  225. McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.
  226. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
  227. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  228. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  229. An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
  230. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  231. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
  232. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  233. Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.
  234. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.
  235. Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.
  236. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  237. Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.
  238. Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.
  239. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.
  240. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  241. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  242. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  243. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  244. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.
  245. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
  246. Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.
  247. Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.
  248. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  249. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  250. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  251. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  252. Patrick Wardle. (2020, June 29). OSX.EvilQuest Uncovered part i: infection, persistence, and more!. Retrieved March 18, 2021.
  253. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  254. Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.
  255. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  256. Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.
  257. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  258. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
  259. Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.
  260. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  261. Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
  262. Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.
  263. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  264. Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.
  265. FinFisher. (n.d.). Retrieved September 12, 2024.
  266. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  267. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  268. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
  269. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  270. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  271. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  272. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  273. Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.
  274. FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.
  275. Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
  276. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
  277. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
  278. Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.
  279. Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022.
  280. Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.
  281. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  282. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
  283. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.
  284. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
  285. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  286. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  287. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  288. Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.
  289. BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.
  290. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  291. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
  292. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  293. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  294. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  295. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  296. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  297. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.
  298. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  299. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  300. Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.
  301. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  302. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  303. Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.
  304. Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.
  305. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  306. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  307. Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.
  308. Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.
  309. GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.
  310. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  311. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  312. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  313. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  314. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  315. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  316. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.
  317. Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.
  318. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  319. Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.
  320. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  321. Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.