Register to stream ATT&CKcon 2.0 October 29-30
ENTERPRISE MOBILE PRE-ATT&CK
TECHNIQUES
  1. Home
  2. Techniques
  3. Enterprise
  4. Process Discovery

Process Discovery

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software running on systems within the network.

Windows

An example command that would obtain details on processes is "tasklist" using the Tasklist utility.

Mac and Linux

In Mac and Linux, this is accomplished with the ps command.

ID: T1057
Tactic: Discovery
Platform: Linux, macOS, Windows
System Requirements: Administrator, SYSTEM may provide better process ownership details
Permissions Required: User, Administrator, SYSTEM
Data Sources: Process monitoring, Process command-line parameters
CAPEC ID: CAPEC-573
Version: 1.0

Procedure Examples

Name Description
4H RAT 4H RAT has the capability to obtain a listing of running processes (including loaded modules). [85]
ADVSTORESHELL ADVSTORESHELL can list running processes. [45]
Agent Tesla Agent Tesla lists the current running processes on the system. [53]
APT1 APT1 gathered a list of running processes on the system using tasklist /v. [107]
APT28 An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions. [34]
APT3 APT3 has a tool that can list out currently running processes. [110] [111]
APT37 APT37's Freenki malware lists running processes using the Microsoft Windows API. [105]
APT38 APT38 leveraged Sysmon to understand the processes, services in the organization. [108]
Astaroth Astaroth searches for different processes on the system. [97]
Azorult Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot. [60] [61]
Backdoor.Oldrea Backdoor.Oldrea collects information about running processes. [13]
BACKSPACE BACKSPACE may collect information about running processes. [14]
Bankshot Bankshot identifies processes and collects the process ids. [42]
BBSRAT BBSRAT can list running processes. [23]
BISCUIT BISCUIT has a command to enumerate running processes and identify their owners. [71]
Bisonal Bisonal can obtain a list of running processes on the victim’s machine. [35]
BLACKCOFFEE BLACKCOFFEE has the capability to discover processes. [57]
BlackEnergy BlackEnergy has gathered a process list by using Tasklist.exe. [32] [33]
Brave Prince Brave Prince lists the running processes. [52]
Cannon Cannon can obtain a list of processes running on the system. [27] [28]
Carbanak Carbanak lists running processes. [31]
Carbon Carbon can list the processes on the victim’s machine. [66]
Cardinal RAT Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance. [72]
ChChes ChChes collects its process identifier (PID) on the victim. [58]
Cobalt Strike Cobalt Strike's "beacon" payload can collect information on process details. [2]
Comnie Comnie uses the tasklist to view running processes on the victim’s machine. [8]
Crimson Crimson contains a command to list processes. [40]
DarkComet DarkComet can list active processes running on the victim’s machine. [65]
Darkhotel Darkhotel has searched for anti-malware strings and anti-virus processes running on the system. [121]
Deep Panda Deep Panda uses the Microsoft Tasklist utility to list processes running on systems. [113]
Derusbi Derusbi collects current and parent process IDs. [43] [44]
Duqu The discovery modules used with Duqu can collect information on process details. [82]
DustySky DustySky collects information about running processes from victims. [12]
Elise Elise enumerates processes via the tasklist command. [62]
ELMER ELMER is capable of performing process listings. [17]
Emotet Emotet has been observed enumerating local processes. [96]
Empire Empire can find information about processes running on local and remote systems. [6]
Epic Epic uses the tasklist /v command to obtain a list of processes. [69] [70]
EvilBunny EvilBunny has used EnumProcesses() to identify how many process are running in the environment. [103]
FELIXROOT FELIXROOT collects a list of running processes. [78]
Final1stspy Final1stspy obtains a list of running processes. [79]
FinFisher FinFisher checks its parent process for indications that it is running in a sandbox setup. [83] [84]
FruitFly FruitFly has the ability to list processes on the system. [22]
GeminiDuke GeminiDuke collects information on running processes and environment variables from the victim. [29]
gh0st RAT gh0st RAT has the capability to list processes. [89]
Gold Dragon Gold Dragon checks the running processes on the victim’s machine. [52]
GravityRAT GravityRAT lists the running processes on the system. [50]
HALFBAKED HALFBAKED can obtain information about running processes on the victim. [68]
Helminth Helminth has used Tasklist to get information on processes. [34]
Honeybee Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server. [106]
Hydraq Hydraq creates a backdoor through which remote attackers can monitor processes. [54] [55]
iKitten iKitten lists the current processes running. [22]
InvisiMole InvisiMole obtains a list of running processes. [10]
Ixeshe Ixeshe can list running processes. [101]
JHUHUGIT JHUHUGIT obtains a list of running processes on the victim. [86] [87]
JPIN JPIN can list running processes. [7]
jRAT jRAT can query and kill system processes. [98]
Kasidet Kasidet has the ability to search for a given process name in processes currently running in the system. [92]
Kazuar Kazuar obtains a list of running processes through WMI querying and the ps command. [37]
Ke3chang Ke3chang performs process discovery using tasklist commands. [114] [115]
KEYMARBLE KEYMARBLE can obtain a list of running processes on the system. [21]
Komplex The OsInfo function in Komplex collects a running process list. [74]
Kwampirs Kwampirs collects a list of running services with the command tasklist /v. [41]
Lazarus Group Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times. [116] [117] [118] [39]
Linfo Linfo creates a backdoor through which remote attackers can retrieve a list of running processes. [80]
Magic Hound Magic Hound malware can list running processes. [122]
MobileOrder MobileOrder has a command to upload information about all running processes to its C2 server. [67]
Molerats Molerats actors obtained a list of active processes on the victim and sent them to C2 servers. [12]
MoonWind MoonWind has a command to return a list of running processes. [75]
Mosquito Mosquito runs tasklist to obtain running processes. [19]
MuddyWater MuddyWater has used malware to obtain a list of running processes on the system. [123]
NavRAT NavRAT uses tasklist /v to check running processes. [30]
NETEAGLE NETEAGLE can send process listings over the C2 channel. [14]
OceanSalt OceanSalt can collect the name and ID for every process running on the system. [26]
OilRig OilRig has run tasklist on a victim's machine. [104]
Orz Orz can gather a process list from the victim. [20]
Pasam Pasam creates a backdoor through which remote attackers can retrieve lists of running processes. [51]
PLAINTEE PLAINTEE performs the tasklist command to list running processes. [36]
PlugX PlugX has a module to list the processes running on a machine. [15]
POORAIM POORAIM can enumerate processes. [16]
Poseidon Group After compromising a victim, Poseidon Group lists all running processes. [112]
PowerDuke PowerDuke has a command to list the victim's processes. [18]
PowerSploit PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process. [3] [4]
PowerStallion PowerStallion has been used to monitor process lists. [102]
POWRUNER POWRUNER may collect process information by running tasklist on a victim. [25]
Proxysvc Proxysvc lists processes running on the system. [39]
Pupy Pupy can list the running processes and get the process ID and parent process’s ID. [1]
RATANKBA RATANKBA lists the system’s processes. [46] [47]
Remsec Remsec can obtain a process list from the victim. [81]
RogueRobin RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals. [77]
ROKRAT ROKRAT lists the current running processes on the system. [64]
RTM RTM can obtain information about process integrity levels. [9]
Seasalt Seasalt has a command to perform a process listing. [71]
SHOTPUT SHOTPUT has a command to obtain a process listing. [11]
Socksbot Socksbot can list all running processes. [88]
Stealth Falcon Stealth Falcon malware gathers a list of running processes. [120]
StreamEx StreamEx has the ability to enumerate processes. [73]
Sykipot Sykipot may gather a list of running processes by running tasklist /v. [38]
SynAck SynAck enumerates all running processes. [48] [49]
Tasklist Tasklist can be used to discover processes running on a system. [5]
Trojan.Karagany Trojan.Karagany can use tasklist to collect a list of running tasks. [13]
Tropic Trooper Tropic Trooper enumerates the running processes on the system. [119]
Turla Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes. [69] [102]
UBoatRAT UBoatRAT can list running processes on the system. [24]
Ursnif Ursnif has gathered information about running processes. [99] [100]
VERMIN VERMIN can get a list of the processes and running tasks on the system. [59]
Volgmer Volgmer can gather a list of processes. [63]
WINERACK WINERACK can enumerate processes. [16]
WinMM WinMM sets a WH_CBT Windows hook to collect information on process creation. [90]
Winnti Group Winnti Group looked for a specific process running on infected servers. [109]
XAgentOSX XAgentOSX contains the getProcessList function to run ps aux to get running processes. [56]
yty yty gets an output of running processes using the tasklist command. [76]
Zebrocy Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system. [27] [93] [28] [94] [95]
Zeus Panda Zeus Panda checks for running processes on the victim’s machine. [91]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

References

  1. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  2. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  3. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  4. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  5. Microsoft. (n.d.). Tasklist. Retrieved December 23, 2015.
  6. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  7. Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.
  8. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  9. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  10. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  11. Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.
  12. ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.
  13. Symantec Security Response. (2014, July 7). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.
  14. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  15. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  16. FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved March 1, 2018.
  17. Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
  18. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  19. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  20. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  21. US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.
  22. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  23. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  24. Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018.
  25. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  26. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  27. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  28. Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.
  29. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.
  30. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  31. Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.
  32. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  33. Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.
  34. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  35. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  36. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  37. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  38. Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
  39. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  40. Huss, D.. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.
  41. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  42. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  43. Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
  44. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  45. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.
  46. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  47. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.
  48. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  49. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  50. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  51. Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.
  52. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  53. Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.
  54. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  55. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  56. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  57. FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.
  58. Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.
  59. Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.
  60. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  61. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  62. Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 14, 2018.
  1. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  2. Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.
  3. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  4. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  5. Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.
  6. Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
  7. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  8. Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.
  9. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  10. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  11. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  12. Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
  13. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  14. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.
  15. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  16. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  17. Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.
  18. Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.
  19. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  20. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  21. FinFisher. (n.d.). Retrieved December 20, 2017.
  22. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  23. Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.
  24. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  25. Lee, B, et al. (2018, February 28). Sofacy Attacks Multiple Government Entities. Retrieved March 15, 2018.
  26. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  27. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  28. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  29. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  30. Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.
  31. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  32. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  33. Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.
  34. ASEC. (2017). ASEC REPORT VOL.88. Retrieved April 16, 2019.
  35. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.
  36. Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.
  37. Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.
  38. Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.
  39. Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.
  40. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  41. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  42. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  43. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  44. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  45. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  46. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  47. Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
  48. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  49. Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.
  50. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
  51. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  52. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  53. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  54. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  55. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved March 2, 2016.
  56. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  57. Ray, V. (2016, November 22). Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy. Retrieved November 9, 2018.
  58. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  59. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  60. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  61. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.