Procedure examples

Saint Bot has been distributed through malicious links contained within spearphishing emails.

Kerrdown has been distributed via e-mails containing a malicious link.

Grandoreiro has been spread via malicious links embedded in e-mails.

Bazar has been spread via emails with embedded malicious links.

Valak has been delivered via malicious links in e-mail.

OutSteel has been distributed through malicious links contained within spearphishing emails.

Melcoz has been spread through malicious links embedded in e-mails.

KOCTOPUS has been distributed as a malicious link within an email.

Qilin has been delivered via malicious links in spearphishing emails.

AppleJeus has been distributed via spearphishing link.

QakBot has spread through emails with malicious links.

Hancitor has been delivered via phishing emails which contained malicious links.

AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.

Kali365 has sent bulk phishing emails containing malicious hyperlinks that direct victims to actor-controlled landing pages impersonating services including SharePoint, OneDrive, Teams, DocuSign, and Adobe Acrobat Sign.

Ninja has been distributed to victims via the messaging app Telegram.

InvisibleFerret has leveraged Telegram chat to upload stolen data using the Telegram API with a bot token.

AppleSeed has exfiltrated files using web services.

DropBook has used legitimate web services to exfiltrate data.

Exbyte exfiltrates collected data to online file hosting sites such as `Mega.co.nz`.

OilCheck can upload documents from compromised hosts to a shared Microsoft Office 365 Outlook email account for exfiltration.

SampleCheck5000 can use the Microsoft Office Exchange Web Services API to access an actor-controlled account and retrieve files for exfiltration.

ngrok has been used by threat actors to configure servers for data exfiltration.

Shai-Hulud has created a repository named `Shai-Hulud` under the compromised account that commits a JSON dump that contains system information, environment variables and collected secrets. Shai-Hulud has also posted stolen credentials to public GitHub repositories.

Empire can use GitHub for data exfiltration.

TeamPCP Cloud Stealer can create a repository in the victim's GitHub account using the victim's own GITHUB_TOKEN to upload stolen credentials.

Mini Shai-Hulud has exfiltrated data through the use of the victim’s own GitHub repository by creating a new public repository using a unique naming convention from a curated list of key words or themes.

Tsundere Botnet’s variant DinDoor has used Rclone to access a Wasabi server.

RainyDay can use a file exfiltration tool to upload specific files to Dropbox.

HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.

ODAgent can use an attacker-controlled OneDrive account for exfiltration.

ROKRAT can send collected data to cloud storage services such as PCloud.

Clambling can send files from a victim's machine to Dropbox.

CreepyDrive can use cloud services including OneDrive for data exfiltration.

BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.

Crutch has exfiltrated stolen data to Dropbox.

OilBooster can exfiltrate files to an actor-controlled OneDrive account via the Microsoft Graph API.

BoomBox can upload data to dedicated per-victim folders in Dropbox.

RIFLESPINE can upload results from executed C2 commands to cloud storage.

Octopus has exfiltrated data to file sharing sites.

Pcexter can upload stolen files to OneDrive storage accounts via HTTP `POST`.

Empire can use Dropbox for data exfiltration.

Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.

Shai-Hulud has exfiltrated repository secrets to `webhook[.]site`.

BRICKSTORM has utilized DNS services sslip.io and nip.io to resolve C2 IP addresses.

Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.

NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.

Bisonal has used a dynamic DNS service for C2.

RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.

SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view", etc. while making connection with the C2, hindering detection efforts.