Procedure examples

APT29 has developed malware variants written in Python.

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.

BRONZE BUTLER has made use of Python-based remote access tools.

Tonto Team has used Python-based tools for execution.

Earth Lusca used Python scripts for port scanning or building reverse shells.

VOID MANTICORE has utilized Python scripts to execute its malicious payloads.

TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.

Indrik Spider has used malicious JavaScript files for several components of their attack.

Kimsuky has used JScript for logging and downloading additional tools. Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.

TA577 has used JavaScript to execute additional malicious payloads.

Evilnum has used malicious JavaScript files on the victim's machine.

APT32 has used JavaScript for drive-by downloads and C2 communications.

MuddyWater has used JavaScript files to execute its POWERSTATS payload.

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.

Leafminer infected victims using JavaScript code.

FIN7 used JavaScript scripts to help perform tasks on the victim's machine.

Sidewinder has used JavaScript to drop and execute malware loaders.

Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.

Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.

Higaisa used JavaScript to execute additional files.

Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.

Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.

Turla has used various JavaScript-based backdoors.

TA505 has used JavaScript for code execution.

Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.

TA578 has used JavaScript files in malware execution chains.

LazyScripter has used JavaScript in its attacks.

APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.

Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.

Silence has used JS scripts.

Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Molerats used various implants, including those built with JS, on target machines.

TeamPCP has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.

ShinyHunters has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command `npm list global authenticode`. Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: ` node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' `.

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.

Storm-0501 has leveraged Cloud CLI to execute commands and exfiltrate data from compromised environments.

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API

ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`.

APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.

UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.

TeamTNT targeted misconfigured containers and used container CLI tools.

TeamPCP has queried the Kubernetes API for local service account tokens and has used `kubectl` for lateral movement.

BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.

Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.

APT32 has used CVE-2016-7255 to escalate privileges.

HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.

ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.

Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).