Procedure examples

Black Basta has used `ShellExecuteA` to shut down and restart the victim system.

XLoader can initiate a system reboot or shutdown.

HermeticWiper can initiate a system shutdown.

LookBack can shutdown and reboot the victim machine.

BFG Agonizer uses elevated privileges to call NtRaiseHardError to induce a "blue screen of death" on infected systems, causing a system crash. Once shut down, the system is no longer bootable.

Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

KillDisk attempts to reboot the machine by terminating specific processes.

Qilin can initiate a reboot of the backup server to hinder recovery.

Remcos can shutdown and restart remote devices.

CanisterWorm has forced the target system to reboot after file deletion.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to download targeted data from SharePoint, and Teams.

During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.

HAFNIUM has exfitrated data from OneDrive.

Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.

Storm-0501 had modified Azure Storage account resources through the `Microsoft.Storage/storageAccounts/write` operation to expose non-remotely accessible accounts for data exfiltration.

APT42 has collected data from Microsoft 365 environments.

Fox Kitten has obtained files from the victim's cloud storage instances.

Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.

AADInternals can collect files from a user’s OneDrive.

TruffleHog has the ability to scan cloud storage services for credentials to include Amazon (AWS) S3 and Google Cloud Storage.

Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.

ShinyHunters has collected data from insecure cloud buckets.

Akira deletes administrator accounts in victim networks prior to encryption.

LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.

LockerGoga has been observed changing account passwords and logging off current users.

MegaCortex has changed user account passwords and logged users off the system.

Meteor has the ability to change the password of local users on compromised hosts and can log off users.

DEADWOOD changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.

During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.

APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.

SameCoin can send its Setup.exe file as an attachment to other addresses in the same compromised organization.

Storm-0501 has copied data from the victims environment to their own infrastructure leveraging AzCopy CLI.

RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.

INC Ransom has used Megasync to exfiltrate data to the cloud.

Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.

During the SolarWinds Compromise, APT29 stole Chrome browser cookies by copying the Chrome profile directories of targeted users.

Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.

Evilnum can steal cookies and session information from browsers.

Sandworm Team used information stealer malware to collect browser session cookies.

Scattered Spider retrieves browser cookies via Raccoon Stealer.

Lotus Blossom has used publicly-available tools to steal cookies from browsers such as Chrome.

Star Blizzard has used EvilGinx to steal the session cookies of victims directed to
phishing domains.

LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.

APT42 has used custom malware to steal login and cookie data from common browsers.

TRANSLATEXT has exfiltrated updated cookies from Google, Naver, Kakao or Daum to the C2 server.