Lateral Tool Transfer

During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network. ^[3]

During the 2016 Ukraine Electric Power Attack, Sandworm Team used move to transfer files to a network share.^[4]

During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable msserver.exe from a staging server to a local hard drive before deployment.^[5]

Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.^[6]

Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.^[7]

APT32 has deployed tools after moving laterally using administrative accounts.^[8]

APT41 uses remote shares to move and remotely execute payloads during lateral movemement.^[9]

BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.^[10]

BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.^[11]

BlackByte Ransomware spreads itself laterally by writing the JavaScript launcher file to mapped shared folders.^[12]

BlackCat can replicate itself across connected servers via psexec.^[13]

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.^[14]

During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.^[15][16]

Chimera has copied tools between compromised hosts using SMB.^[17]

cmd can be used to copy files to/from a remotely connected internal system.^[18]

DustySky searches for network drives and removable media and duplicates itself onto them.^[19]

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.^[20]

Emotet has copied itself to remote systems using the service.exe filename.^[21]

esentutl can be used to copy files to/from a remote share.^[22]

Expand can be used to download or upload a file over a network share.^[23]

FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.^[24]

ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.^[25][26]

GALLIUM has used PsExec to move laterally between hosts in the target network.^[27]

Havoc has the ability to copy files from one location to another.^[28]

HermeticWizard can copy files to other machines on a compromised network.^[29]

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.^[30]

Impacket has used its wmiexec command, leveraging Windows Management Instrumentation, to remotely stage and execute payloads in victim networks.^[31]

INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.^[32][33]

INC Ransomware can push its encryption executable to multiple endpoints within compromised infrastructure.^[32]

IPsec Helper can download additional payloads from command and control nodes and execute them.^[34]

LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.^[1]

Lucifer can use certutil for propagation on Windows hosts within intranets.^[35]

Magic Hound has copied tools within a compromised network using RDP.^[36]

Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.^[37]

Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.^[38]

Olympic Destroyer attempts to copy itself to remote machines on the network.^[39]

During Operation Wocao, threat actors used SMB to copy files to and from target systems.^[40]

OutSteel can download the Saint Bot malware for follow-on execution.^[41]

PsExec can be used to download or upload a file over a network share.^[42]

Sandworm Team has used move to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.^[4][43] Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.^[5]

Shamoon attempts to copy itself to remote machines on the network.^[44]

During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.^[45]

Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.^[46]

Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.^[47]

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.^[48][49]

UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.^[50]

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.^[31]

VIRTUALPIE has file transfer capabilities.^[51]

VIRTUALPITA is capable of file transfer and arbitrary command execution.^[51]

Volt Typhoon has copied web shells between servers in targeted environments.^[52]

WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.^[53]

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.^[54]

Consider using the host firewall to restrict file sharing communications such as SMB. ^[55]

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. ^[56]