1. Home
  2. Techniques
  3. Enterprise
  4. Data from Local System

Data from Local System

Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Adversaries may do this using a Command and Scripting Interpreter, such as cmd, which has functionality to interact with the file system to gather information. Some adversaries may also use Automated Collection on the local system.

ID: T1005
Sub-techniques:  No sub-techniques
ⓘ
Tactic: Collection
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
System Requirements: Privileges to access certain files and directories
Contributors: William Cain
Version: 1.3
Created: 31 May 2017
Last Modified: 15 October 2021
Provided by LAYER 8

Procedure Examples

ID Name Description
G0138 Andariel

Andariel has collected large numbers of files from compromised network systems for later extraction.[1]
S0622 AppleSeed

AppleSeed can collect data on a compromised host.[2]
G0006 APT1

APT1 has collected files from a local victim.[3]
G0007 APT28

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.[4][5][6][7]
G0016 APT29

APT29 has extracted files from compromised networks.[8]

G0022 APT3

APT3 will identify Microsoft Office documents on the victim's computer.[9]
G0067 APT37

APT37 has collected data from victims' local systems.[10]
G0082 APT38

APT38 has collected data from a compromised host.[11]
G0087 APT39

APT39 has used various tools to steal files from the compromised host.[12][13]
G0096 APT41

APT41 has uploaded files and data from a compromised host.[14]
S0642 BADFLICK

BADFLICK has uploaded files from victims' machines.[15]
S0128 BADNEWS

When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[16][17]
S0337 BadPatch

BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.[18]
S0234 Bandook

Bandook can collect local files from the system .[19]

S0239 Bankshot

Bankshot collects files from the local system.[20]
S0534 Bazar

Bazar can retrieve information from the infected machine.[21]
S0564 BlackMould

BlackMould can copy files on a compromised host.[22]
S0520 BLINDINGCAN

BLINDINGCAN has uploaded files from victim machines.[23]
S0651 BoxCaon

BoxCaon can upload files from a compromised host.[24]
G0060 BRONZE BUTLER

BRONZE BUTLER has exfiltrated files stolen from local systems.[25]
S0274 Calisto

Calisto can collect data from user directories.[26]
S0572 Caterpillar WebShell

Caterpillar WebShell has a module to collect information from the local database.[27]

S0020 China Chopper

China Chopper's server component can upload local files.[28][29][30]
S0154 Cobalt Strike

Cobalt Strike can collect data from a local system.[31][32]
S0492 CookieMiner

CookieMiner has retrieved iPhone text messages from iTunes phone backup files.[33]
S0050 CosmicDuke

CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.[34]
S0538 Crutch

Crutch can exfiltrate files from compromised systems.[35]
S0498 Cryptoistic

Cryptoistic can retrieve files from the local file system.[36]
G0070 Dark Caracal

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.[37]
G0074 Dragonfly 2.0

Dragonfly 2.0 collected data from local victim systems.[38]
S0502 Drovorub

Drovorub can transfer files from the victim machine.[39]
S0567 Dtrack

Dtrack can collect a variety of information from victim machines.[40]
G0031 Dust Storm

Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.[41]
S0634 EnvyScout

EnvyScout can collect sensitive NTLM material from a compromised host.[42]
S0404 esentutl

esentutl can be used to collect data from local file systems.[43]
S0512 FatDuke

FatDuke can copy files and directories from a compromised host.[44]
G0037 FIN6

FIN6 has collected and exfiltrated payment card data from compromised systems.[45][46][47]
G0046 FIN7

FIN7 has collected files and other sensitive information from a compromised network.[48]
S0036 FLASHFLOOD

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.[49]
S0193 Forfiles

Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).[4]
G0117 Fox Kitten

Fox Kitten has searched local system resources to access sensitive documents.[50]
S0503 FrameworkPOS

FrameworkPOS can collect elements related to credit card data from process memory.[51]
G0101 Frankenstein

Frankenstein has enumerated hosts via Empire, gathering various local system information.[52]
G0093 GALLIUM

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.[53]
G0047 Gamaredon Group

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.[54]
S0477 Goopy

Goopy has the ability to exfiltrate documents from infected systems.[55]

S0237 GravityRAT

GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.[56]
S0632 GrimAgent

GrimAgent can collect data and files from a compromised host.[57]
G0072 Honeybee

Honeybee collects data from the local victim system.[58]
S0203 Hydraq

Hydraq creates a backdoor through which remote attackers can read data from files.[59][60]
G0100 Inception

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.[61]
S0260 InvisiMole

InvisiMole can collect data from the system, and can monitor changes in specified directories.[62]
S0015 Ixeshe

Ixeshe can collect data from a local system.[63]
S0265 Kazuar

Kazuar uploads files from a specified directory to the C2 server.[64]
G0004 Ke3chang

Ke3chang gathered information and files from local directories for exfiltration.[65]
S0526 KGH_SPY

KGH_SPY can send a file containing victim system information to C2.[66]
G0094 Kimsuky

Kimsuky has collected Office, PDF, and HWP documents from its victims.[67]
S0250 Koadic

Koadic can download files off the target system to send back to the server.[68]
G0032 Lazarus Group

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers. Lazarus Group malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.[69][70][71]
S0395 LightNeuron

LightNeuron can collect files from a local system.[72]
S0211 Linfo

Linfo creates a backdoor through which remote attackers can obtain data from local systems.[73]
S0409 Machete

Machete searches the File system for files of interest.[74]

S0652 MarkiRAT

MarkiRAT can upload data from the victim's machine to the C2 server.[75]
S0500 MCMD

MCMD has the ability to upload files from an infected device.[76]
G0045 menuPass

menuPass has collected various files from the compromised computers.[77][78]
S0079 MobileOrder

MobileOrder exfiltrates data collected from the victim mobile device.[79]
S0630 Nebulae

Nebulae has the capability to upload collected files to C2.[80]
S0385 njRAT

njRAT can collect data from a local system.[81]
S0340 Octopus

Octopus can exfiltrate files from the system using a documents collector tool.[82]
G0116 Operation Wocao

Operation Wocao has exfiltrated files and directories of interest from the targeted system.[83]
S0352 OSX_OCEANLOTUS.D

OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.[84]
S0594 Out1

Out1 can copy files and Registry data from compromised hosts.[85]
S0598 P.A.S. Webshell

P.A.S. Webshell has the ability to copy files on a compromised host.[86]
S0208 Pasam

Pasam creates a backdoor through which remote attackers can retrieve files.[87]
G0040 Patchwork

Patchwork collected and exfiltrated files from the infected system.[88]
S0517 Pillowmint

Pillowmint has collected credit card data using native API functions.[89]
S0048 PinchDuke

PinchDuke collects user files from the compromised host based on predefined file extensions.[90]
S0012 PoisonIvy

PoisonIvy creates a backdoor through which remote attackers can steal system information.[91]
S0194 PowerSploit

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.[92][93]
S0223 POWERSTATS

POWERSTATS can upload files from compromised hosts.[94]
S0238 Proxysvc

Proxysvc searches the local system and gathers data.[95]
S0197 PUNCHTRACK

PUNCHTRACK scrapes memory for properly formatted payment card data.[96][97]
S0650 QakBot

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.[98][99]
S0629 RainyDay

RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.[80]
S0458 Ramsay

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.[100][101]

S0169 RawPOS

RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.[102][103][104]
S0240 ROKRAT

ROKRAT can request to upload collected host data and additional files.[105]
S0090 Rover

Rover searches for files on local drives based on a predefined list of file extensions.[106]
G0034 Sandworm Team

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.[107]
S0461 SDBbot

SDBbot has the ability to access the file system on a compromised host.[108]
S0444 ShimRat

ShimRat has the capability to upload collected files to a C2.[109]

S0610 SideTwist

SideTwist has the ability to upload files from a compromised host.[110]
S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has uploaded files and information from victim machines.[111]
S0615 SombRAT

SombRAT has collected data and files from a compromised host.[112][113]
S0646 SpicyOmelette

SpicyOmelette has collected data and other information from a compromised host.[114]
G0038 Stealth Falcon

Stealth Falcon malware gathers data from the local victim system.[115]
S0559 SUNBURST

SUNBURST collected information from a compromised host.[116][117]
S0011 Taidoor

Taidoor can upload data and files from a victim's machine.[118]
S0467 TajMahal

TajMahal has the ability to steal documents from the local system including the print spooler queue.[119]
G0027 Threat Group-3390

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[120]
S0266 TrickBot

TrickBot collects local files and information from the victim’s local machine.[121]
G0010 Turla

Turla RPC backdoors can upload files from victim machines.[122]
S0386 Ursnif

Ursnif has collected files from victim machines, including certificates and cookies.[123]
S0452 USBferry

USBferry can collect information from an air-gapped host machine.[124]

S0515 WellMail

WellMail can exfiltrate files from the victim machine.[125]
S0514 WellMess

WellMess can send files from the victim machine to C2.[126][127]
S0645 Wevtutil

Wevtutil can be used to export events from a specific log.[128][129]
G0124 Windigo

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.[130]
S0653 xCaon

xCaon has uploaded files from victims' machines.[24]
S0658 XCSSET

XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.[131]
S0248 yty

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.[132]

Mitigations

ID Mitigation Description
M1057 Data Loss Prevention

Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Access
DS0012 Script Script Execution

Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 29, 2021.
  2. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  3. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  4. Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.
  5. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  6. Hacquebord, F. (n.d.). Pawn Storm in 2019 A Year of Scanning and Credential Phishing on High-Profile Targets. Retrieved December 29, 2020.
  7. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
  8. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  9. valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.
  10. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  11. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  12. Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.
  13. FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
  14. Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.
  15. Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.
  16. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
  17. Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.
  18. Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.
  19. Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
  20. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  21. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  22. MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
  23. US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.
  24. CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
  25. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  26. Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.
  27. ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  28. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  29. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
  30. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  31. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  32. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  33. Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.
  34. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  35. Faou, M. (2020, December 2). Turla Crutch: Keeping the “back door” open. Retrieved December 4, 2020.
  36. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  37. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  38. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  39. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.
  40. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  41. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  42. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
  43. Red Canary. (2021, March 31). 2021 Threat Detection Report. Retrieved August 31, 2021.
  44. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  45. Chen, J. (2019, October 10). Magecart Card Skimmers Injected Into Online Shops. Retrieved September 9, 2020.
  46. Klijnsma, Y. (2018, September 11). Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims. Retrieved September 9, 2020.
  47. Klijnsma, Y. (2018, September 19). Another Victim of the Magecart Assault Emerges: Newegg. Retrieved September 9, 2020.
  48. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.
  49. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  50. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
  51. Kremez, V. (2019, September 19). FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals. Retrieved September 8, 2020.
  52. Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.
  53. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  54. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  55. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  56. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  57. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021.
  58. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  59. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  60. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  61. GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.
  62. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  63. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  64. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  65. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  66. Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.
  1. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
  2. Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
  3. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  4. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  5. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Remote Administration Tools & Content Staging Malware Report. Retrieved March 16, 2016.
  6. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
  7. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  8. ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.
  9. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  10. Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
  11. United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.
  12. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
  13. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  14. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  15. Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
  16. Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.
  17. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  18. Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.
  19. Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.
  20. ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.
  21. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  22. Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016.
  23. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  24. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  25. Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
  26. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  27. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  28. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  29. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  30. Kizhakkinan, D. et al.. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
  31. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  32. Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.
  33. Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.
  34. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  35. Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.
  36. Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
  37. TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
  38. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  39. Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.
  40. Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.
  41. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  42. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  43. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  44. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  45. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  46. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  47. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  48. CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.
  49. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  50. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  51. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  52. Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.
  53. GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.
  54. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  55. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  56. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  57. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  58. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  59. CISA. (2020, July 16). MAR-10296782-3.v1 – WELLMAIL. Retrieved September 29, 2020.
  60. PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
  61. CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.
  62. Microsoft. (n.d.). wevtutil. Retrieved September 14, 2021.
  63. F-Secure Labs. (2020, August 18). Lazarus Group Campaign Targeting the Cryptocurrency Vertical. Retrieved September 1, 2020.
  64. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  65. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
  66. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.