Procedure examples

Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.

Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. TONESHELL variants have utilized FakeTLS headers with the bytes `0x17 0x03 0x03` to represent TLSv1.2 and `0x17 0x03 0x04` for TLSv1.3.

BOOKWORM has modified HTTP POST requests to resemble legitimate communications.

PUBLOAD has modified HTTP POST requests to resemble legitimate communications. PUBLOAD used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. PUBLOAD has utilized FakeTLS headers with the bytes 17 03 03.

InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.

Okrum leverages the HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.

TAINTEDSCRIBE has used FakeTLS for session authentication.

Uroburos can use custom communication methodologies that ride over common protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.

BADCALL uses a FakeTLS method during C2.

Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI. Cobalt Strike has also added Host: ocsp.verisign.com to HTTP headers to mimic Online Certificate Status Protocol (OCSP) traffic.

SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.

FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.

FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.

HARDRAIN uses FakeTLS to communicate with its C2 server.

StarProxy has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. StarProxy used FakeTLS to communicate with its C2 server.

FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.

Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.

APT39 has used different versions of Mimikatz to obtain credentials.

Carbanak obtains Windows logon password details.

MgBot includes modules for dumping and capturing credentials from process memory.

Revenge RAT has a plugin for credential harvesting.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.

OnionDuke steals credentials from its victims.

Mustang Panda utilized “Hdump” to dump credentials from memory.

Tonto Team has used a variety of credential dumping tools.

APT32 used GetPassword_x64 to harvest credentials.

HOMEFRY can perform credential dumping.

Suckfly used a signed credential-dumping tool to obtain victim account credentials.

BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.

APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.

Sowbug has used credential dumping tools.

Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.

Axiom has been known to dump credentials.

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.

During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.

In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.

During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.

During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.

During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.

During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.

During the 2025 Poland Wiper Attacks, the adversaries attempted to dump credentials utilizing LSASS.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.

During Operation Wocao, threat actors used ProcDump to dump credentials from memory.

Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.

GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."