Automated Collection

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.^[2]

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.^[3]

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.^[4]

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.^[5]

APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.^[6]

Attor has automatically collected data about the compromised system.^[7]

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.^[8]

Bankshot recursively generates a list of files within a directory and sends them back to the control server.^[9]

ccf32 can be used to automatically collect files from a compromised host.^[10]

Chimera has used custom DLLs for continuous retrieval of data from memory.^[11]

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.^[12]

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.^[13]

Crutch can automatically monitor removable drives in a loop and copy interesting files.^[14]

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.^[15]

Ember Bear engages in mass collection from compromised systems during intrusions.^[16]

Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.^[17]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[18]

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.^[19][20]

During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.^[17]

FunnyDream can monitor files for changes and automatically collect them.^[10]

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.^[21]

GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.^[22]

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.^[23]

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.^[24][25]

Ke3chang has performed frequent and scheduled data collection from victim networks.^[26]

LightNeuron can be configured to automatically collect files under a specified directory.^[27]

LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.^[28]

menuPass has used the Csvde tool to collect Active Directory files and data.^[29]

MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.^[30]

Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.^[31]

Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).^[32]

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.^[33]

Mythic supports scripting of file downloads from agents.^[34]

NETWIRE can automatically archive collected data.^[35]

NPPSPY collection is automatically recorded to a specified file on the victim machine.^[36]

OilRig has used automated collection.^[37]

During Operation Wocao, threat actors used a script to collect information about the infected system.^[38]

OutSteel can automatically scan for and collect files with specific extensions.^[39]

PACEMAKER can enter a loop to read /proc/ entries every 2 seconds in order to read a target application's memory.^[40]

Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.^[41]

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.^[8]

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.^[42]

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.^[43]

Proxysvc automatically collects data about the victim and sends it to the control server.^[44]

Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.^[45][46][47]

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.^[48]

RedCurl has used batch scripts to collect data.^[49][50]

ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.^[51]

Depending on the Linux distribution, RotaJakiro executes a set of commands to collect device information and sends the collected information to the C2 server.^[52]

Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.^[53]

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.^[54][55]

ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.^[56]

Sidewinder has used tools to automatically collect system and network configuration information.^[57]

StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.^[58]

T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.^[59]

TajMahal has the ability to index and compress files into a send queue for exfiltration.^[60]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[61]

Tropic Trooper has collected information automatically using the adversary's USBferry attack.^[62]

For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.^[63]

Valak can download a module to search for and build a report of harvested credential data.^[64]

VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .^[65]

WindTail can identify and add files that possess specific file extensions to an array for archiving.^[66]

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.^[67]

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.^[68][69]

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. Strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through Brute Force techniques.

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means.