Procedure examples

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.

Mustang Panda has encrypted documents with RC4 prior to exfiltration.

UNC3886 has XOR encrypted and Gzip compressed captured credentials.

Lotus Blossom has used custom tools to compress and archive data on victim systems.

A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.

CopyKittens encrypts data with a substitute cipher prior to exfiltration.

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.

Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.

VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers. VOID MANTICORE has also utilized legitimate remote disk wiping commands.

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.

Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).

Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.

Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.

VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.

Axiom has targeted victims with remote administration tools including RDP.

APT32's macOS backdoor hides the clientID file via a chflags function.

HAFNIUM has hidden files on a compromised host.

FIN7 has used `attrib +h “C:\ProgramData\ssh”` to make the SSH folder hidden.

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to `hidden` and `system`.

Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.

RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.

LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.

APT28 has saved files with hidden file attributes.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.

FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.

TeamPCP has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed malware.

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.

Dragonfly has modified the Registry to hide created user accounts.

APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.

Kimsuky has used an information gathering module that will hide an AV software window from the victim. Kimsuky has also been known to use `-WindowStyle Hidden` to conceal PowerShell windows.

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

APT32 has used the WindowStyle parameter to conceal PowerShell windows.

Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.

FIN7 has used .txt files to conceal PowerShell commands.

Higaisa used a payload that creates a hidden window.

DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.

Medusa Group has utilized the `ShowWindow` API function to hide the current window.

Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.

APT28 has used the WindowStyle parameter to conceal PowerShell windows.

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.

CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Nomadic Octopus executed PowerShell in a hidden window.

APT32 used NTFS alternate data streams to hide their payloads.