Procedure examples

LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.

Kali365 has the ability to modify email rules to delete email based notifications prior to the victim seeing them.

Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.

OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.

SombRAT has the ability to modify its process memory to hide process command-line arguments.

Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.

BOLDMOVE calls the signal function to ignore the signals SIGCHLD, SIGHIP, and SIGPIPE prior to starting primary logic.

The GoldMax Linux variant has been executed with the `nohup` command to ignore hangup signals and continue to run if the terminal session was terminated.

BPFDoor sets its process to ignore the following signals; `SIGHUP`, `SIGINT`, `SIGQUIT`, `SIGPIPE`, `SIGCHLD`, `SIGTTIN`, and `SIGTTOU`.

Shai-Hulud has suppressed NPM warnings by silently exiting through the use of the NPM success code that has a setting that all errors exit with `code 0`.

OSX/Shlayer has used the `nohup` command to instruct executed payloads to ignore hangup signals.

Mini Shai-Hulud has suppressed output so that nothing is printed to terminal and has utilized silent exiting when environmental variables match restricted values.

PHASEJAM has blocked legitimate upgrades of Ivanti Connect Secure systems and falsely indicates a successful upgrade while operating on an older version.

MultiLayer Wiper changes the original path information of deleted files to make recovery efforts more difficult.

SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.

LightNeuron is capable of modifying email content, headers, and attachments during transit.

GlassWorm can intercept and modify transaction details associated with hardware wallet applications before signing.

Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.

Royal has been spread through the use of phishing campaigns including "call back phishing" where victims are lured into calling a number provided through email.

Hikit has been spread through spear phishing.

INC Ransomware campaigns have used spearphishing emails for initial access.

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.

Bumblebee has gained execution through luring users into opening malicious attachments.

KOPILUWAK has been delivered to victims as a malicious email attachment.

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.

Pony has been delivered via spearphishing attachments.

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.

AppleSeed has been distributed to victims through malicious e-mail attachments.

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.

EnvyScout has been distributed via spearphishing as an email attachment.

Emotet has been delivered by phishing emails containing attachments.

Woody RAT has been delivered via malicious Word documents and archive files.

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.

Snip3 has been delivered to victims through malicious e-mail attachments.

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

RustyWater has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.

IcedID has been delivered via phishing e-mails with malicious attachments.

Flagpro has been distributed via spearphishing as an email attachment.

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.

Javali has been delivered as malicious e-mail attachments.

Bisonal has been delivered as malicious email attachments.

Lumma Stealer has been delivered through phishing emails with malicious attachments.

Clambling has been delivered to victim's machines through malicious e-mail attachments.

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.

Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.