PsExec

^[5]

^[6]

^[7]

^[8]

Thrip used PsExec to move laterally between computers on the victim’s network.^[9]

^[10]

^[11]

^[12]

^[13]

^{[14][15][16][17]}

^[18]

Storm-1811 has used PsExec for remote process execution.^[19]

^[20]

^[21]

^[22][23][24]

^[25]

FIN5 uses a customized version of PsExec.^[26]

^[27][28]

^[29]

^[30][31]

^[32]

^[33][34]

^[35][36]

BlackByte has used PsExec to remotely execute payloads during wormable ransomware execution.^[37]

Ember Bear has used PsExec through frameworks such as Impacket for remote command execution.^[38]

^[39]

^[40]

^[41]

^[42][43]

^{[44][45][46][47]}

^[48]

^[49]

^[50][51]

^[52]

^[53]

^[54][55]

^[56][57][58]

During CostaRicto, threat actors used PsExec.^[59]

During Night Dragon, threat actors used PsExec to remotely execute droppers.^[60]

For Operation Ghost, APT29 used PsExec for lateral movement on compromised networks.^[36]

During Operation Wocao, threat actors used PsExec to interact with other systems inside the internal network.^[61]