Obtain Capabilities: Tool

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.^[2]

APT-C-36 obtained and used a modified variant of Imminent Monitor.^[3]

APT1 has used various open-source tools for privilege escalation purposes.^[4]

APT19 has obtained and used publicly-available tools like Empire.^[5][6]

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.^[7][8][9]

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.^[10][11][12]

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.^[13][14]

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.^[15][16]

APT38 has obtained and used open-source tools such as Mimikatz.^[17]

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.^[18][19]

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.^[20]

Aquatic Panda has acquired and used Cobalt Strike in its operations.^[21]

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.^[22]

BITTER has obtained tools such as PuTTY for use in their operations.^[23]

BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.^[24]

Blue Mockingbird has obtained and used tools such as Mimikatz.^[25]

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.^[26]

For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.^[27]

For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.^[28]

For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.^[29]

For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.^[30][31]

For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.^[32][33]

During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.^[34]

During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.^[35]

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.^[36]

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.^[37][38]

Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.^[39][40]

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.^[41]

Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.^[42]

CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.^[43][44]

During CostaRicto, the threat actors obtained open source tools to use in their operations.^[45]

During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.^[46][47]

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.^[48]

DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.^[49]

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.^[50]

Earth Lusca has acquired and used a variety of open source tools.^[51]

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.^[52]

FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.^[53]

FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.^[54]

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.^[55]

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.^[56][57]

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.^[58]

FIN8 has used open-source tools such as Impacket for targeting efforts.^[59]

For Frankenstein, the threat actors obtained and used Empire.^[60]

For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.^[61]

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.^[62]

Gamaredon Group has used various legitimate tools, such as mshta.exe and Reg, and services during operations.^[63]

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.^[64]

HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.^[65][66][67]

During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.^[68][69]

INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.^{[70][71][72][73][74]}

Inception has obtained and used open-source tools such as LaZagne.^[75]

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.^[76][77]

Ke3chang has obtained and used tools such as Mimikatz.^[78]

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.^[79][80][81]

LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.^[82][83]

Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.^[84]

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.^[85]

LuminousMoth has obtained an ARP spoofing tool from GitHub.^[86]

Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.^{[87][88][89][90][91]}

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.^[92]

Metador has used Microsoft's Console Debugger in some of their operations.^[93]

Moses Staff has used the commercial tool DiskCryptor.^[94]

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.^[95][96]

During Night Dragon, threat actors obtained and used tools such as gsecdump.^[97]

For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.^[98]

For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.^[99][100]

For Operation Spalax, the threat actors obtained packers such as CyaX.^[101]

For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.^[102]

Patchwork has obtained and used open-source tools such as QuasarRAT.^[103]

PittyTiger has obtained and used tools such as Mimikatz and gsecdump.^[104]

Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.^[105]

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.^[44]

Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations.^[106][107] Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.^[108]

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.^{[109] [110]}

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.^[111][112]

Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.^[113][114]

TA2541 has used commodity remote access tools.^[115]

TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.^[116]

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.^[117][118]

Thrip has obtained and used tools such as Mimikatz and PsExec.^[119]

In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.^[120]

Turla has obtained and customized publicly-available tools like Mimikatz.^[121]

Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.^[122][123]

Whitefly has obtained and used tools such as Mimikatz.^[124]

WIRTE has obtained and used Empire for post-exploitation activities.^[125]

Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.^[126][127]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.