Procedure examples

During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.

KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.

During SharePoint ToolShell Exploitation, threat actors used a loader to download and execute ransomware.

During Frankenstein, the threat actors downloaded files and tools onto a victim machine.

During RedPenguin, UNC3886 used backdoor malware capable of downloading files to compromised infrastructure.

During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.

During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.

During Operation MidnightEclipse, threat actors downloaded additional payloads on compromised devices.

During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.

During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.

Water Curupira Pikabot Distribution used Curl.exe to download the Pikabot payload from an external server, saving the file to the victim machine's temporary directory.

During ShadowRay, threat actors downloaded and executed the XMRig miner on targeted hosts.

During C0021, the threat actors downloaded additional tools and files onto victim machines.

During C0015, the threat actors downloaded additional tools and files onto a compromised network.

During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.

During the SolarWinds Compromise, APT29 downloaded additional malware, such as TEARDROP and Cobalt Strike, onto a compromised host following initial access.

During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.

During Outer Space, OilRig downloaded additional tools to comrpomised infrastructure.

During the 2025 Poland Wiper Attacks, the adversaries downloaded malicious payloads to the victim server.

During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.

APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.

During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.

During Operation Wocao, threat actors downloaded additional files to the infected system.

During C0017, APT41 downloaded malicious payloads onto compromised systems.

During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.

During C0027, Scattered Spider downloaded tools using victim organization systems.

Quad7 Activity has downloaded additional binaries from a remote File Transfer Protocol (FTP) server to compromised devices.

During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.