PsExec

^[5]

^[6]

^[7]

^[8]

Thrip used PsExec to move laterally between computers on the victim’s network.^[9]

^[10]

^[11]

^[12]

^[13]

^{[14][15][16][17]}

^[18]

Storm-1811 has used PsExec for remote process execution.^[19]

^[20]

^[21]

^[22][23][24]

^[25]

FIN5 uses a customized version of PsExec.^[26]

^[27][28]

^[29]

^[30][31]

^[32]

^[33][34]

^[35][36]

BlackByte has used PsExec to remotely execute payloads during wormable ransomware execution.^[37]

Ember Bear has used PsExec through frameworks such as Impacket for remote command execution.^[38]

^[39]

^[40]

Medusa Group has utilized PsExec to facilitate execution, lateral movement, defense evasion, and exfiltration.^[41]

^[42]

^[43][44]

^{[45][46][47][48]}

^[49]

^[50]

^[51][52]

^[53]

^[54]

^[55][56]

^[57][58][59]

During CostaRicto, threat actors used PsExec.^[60]

During Night Dragon, threat actors used PsExec to remotely execute droppers.^[61]

For Operation Ghost, APT29 used PsExec for lateral movement on compromised networks.^[36]

During Operation Wocao, threat actors used PsExec to interact with other systems inside the internal network.^[62]

^[63]