Procedure examples

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.

Quad7 Activity has compromised various branded SOHO routers to form a botnet that has been leveraged in password spraying activity.

Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.

HAFNIUM has used compromised devices in covert networks to obfuscate communications.

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.

Axiom has used large groups of compromised machines for use as proxy nodes.

APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.

During Operation MidnightEclipse, threat actors abused compromised AWS buckets to store files.

CURIUM has compromised legitimate websites to enable strategic website compromise attacks.

Winter Vivern has used compromised WordPress sites to host malicious payloads for download.

Turla has frequently used compromised WordPress sites for C2 infrastructure.

Earth Lusca has compromised Google Drive repositories.

Gootloader can insert malicious scripts to compromise vulnerable content management systems (CMS).

KV Botnet Activity focuses on compromise of small office-home office (SOHO) network devices to build the subsequent botnet.

During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.

During the 2025 Poland Wiper Attacks, the adversaries used compromised Cisco routers for network communications.

Versa Director Zero Day Exploitation used compromised small office/home office (SOHO) devices to interact with vulnerable Versa Director servers.

Quad7 Activity has compromised network devices, such as IP cameras, Network Attached Storage (NAS) devices, and SOHO routers, to leverage for follow-on activity.

FLORAHOX Activity has compromised network routers and IoT devices for the ORB network.

Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.

ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.

Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.

APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.

During Salesforce Data Exfiltration, threat actors created Salesforce trial accounts to register their malicious applications.

APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.

Kimsuky has leveraged stolen PII to create accounts.

Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.

Ember Bear has created accounts on dark web forums to obtain various tools and malware.

Fox Kitten has created KeyBase accounts to communicate with ransomware victims.

For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.

For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

EXOTIC LILY has established social media profiles to mimic employees of targeted companies.

APT32 has set up Facebook pages in tandem with fake websites.

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.

Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.

Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.

Leviathan has created new social media accounts for targeting efforts.

Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.

Medusa Group has created social media accounts including Telegram and X to publicize their activities.

Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.

Water Galura operates a news channel on Telegram to make announcements for the Qilin RaaS.

Fox Kitten has used a Twitter account to communicate with ransomware victims.

Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.

Moonstone Sleet has created social media accounts to interact with victims.

VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

TeamPCP has used its own Telegram channel and X accounts @pcpcats and @xploitrsturtle2 for external communications.