Native API, Technique T1106 - Enterprise

<!DOCTYPE html> <html lang='en'> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=UA-62667723-1"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-62667723-1'); </script> <meta name="google-site-verification" content="2oJKLqNN62z6AOCb0A0IXGtbQuj-lev5YPAHFF_cbHQ"/> <meta charset='utf-8'> <meta name='viewport' content='width=device-width, initial-scale=1,shrink-to-fit=no'> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <link rel='shortcut icon' href='/theme/favicon.ico' type='image/x-icon'> <title>Native API, Technique T1106 - Enterprise | MITRE ATT&CK®</title>   <link rel='stylesheet' href='/theme/style/bootstrap.min.css' /> <link rel='stylesheet' href='/theme/style/bootstrap-tourist.css' /> <link rel='stylesheet' href='/theme/style/bootstrap-select.min.css' />  <link rel="stylesheet" href="/theme/style/fontawesome-6.5.1/css/fontawesome.min.css"/> <link rel="stylesheet" href="/theme/style/fontawesome-6.5.1/css/brands.min.css"/> <link rel="stylesheet" href="/theme/style/fontawesome-6.5.1/css/solid.min.css"/> <link rel="stylesheet" type="text/css" href="/theme/style.min.css?6689c2db"> </head> <body> <div class="container-fluid attack-website-wrapper d-flex flex-column h-100"> <div class="row sticky-top flex-grow-0 flex-shrink-1">  <header class="col px-0"> <nav class='navbar navbar-expand-lg navbar-dark position-static'> <a class='navbar-brand' href='/'><img src="/theme/images/mitre_attack_logo.png" class="attack-logo"></a> <button class='navbar-toggler' type='button' data-toggle='collapse' data-target='#navbarCollapse' aria-controls='navbarCollapse' aria-expanded='false' aria-label='Toggle navigation'> </button> <div class='collapse navbar-collapse' id='navbarCollapse'> <ul class='nav nav-tabs ml-auto'> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/matrices/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Matrices </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/matrices/enterprise/">Enterprise</a> <a class="dropdown-item" href="/matrices/mobile/">Mobile</a> <a class="dropdown-item" href="/matrices/ics/">ICS</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/tactics/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Tactics </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/tactics/enterprise/">Enterprise</a> <a class="dropdown-item" href="/tactics/mobile/">Mobile</a> <a class="dropdown-item" href="/tactics/ics/">ICS</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/techniques/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Techniques </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/techniques/enterprise/">Enterprise</a> <a class="dropdown-item" href="/techniques/mobile/">Mobile</a> <a class="dropdown-item" href="/techniques/ics/">ICS</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/datasources" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Defenses </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/datasources">Data Sources</a> <div class="dropright dropdown"> <a class="dropdown-item dropdown-toggle" href="/mitigations/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Mitigations </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/mitigations/enterprise/">Enterprise</a> <a class="dropdown-item" href="/mitigations/mobile/">Mobile</a> <a class="dropdown-item" href="/mitigations/ics/">ICS</a> </div> </div> <a class="dropdown-item" href="/assets">Assets</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/groups" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> CTI </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/groups">Groups</a> <a class="dropdown-item" href="/software">Software</a> <a class="dropdown-item" href="/campaigns">Campaigns</a> </div> </li> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="/resources/" id="navbarDropdown" role="button" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Resources </a> <div class="dropdown-menu " aria-labelledby="navbarDropdown"> <a class="dropdown-item" href="/resources/">Get Started</a> <a class="dropdown-item" href="/resources/learn-more-about-attack/">Learn More about ATT&CK</a> <a class="dropdown-item" href="/resources/attackcon/">ATT&CKcon</a> <a class="dropdown-item" href="/resources/attack-data-and-tools/">ATT&CK Data & Tools</a> <a class="dropdown-item" href="/resources/faq/">FAQ</a> <a class="dropdown-item" href="/resources/engage-with-attack/contact/">Engage with ATT&CK</a> <a class="dropdown-item" href="/resources/versions/">Version History</a> <a class="dropdown-item" href="/resources/legal-and-branding/">Legal & Branding</a> </div> </li> <li class="nav-item"> <a href="/resources/engage-with-attack/benefactors/" class="nav-link" >Benefactors</a> </li> <li class="nav-item"> <a href="https://medium.com/mitre-attack/" target="_blank" class="nav-link"> Blog  <img src="/theme/images/external-site.svg" alt="External site" class="external-icon" /> </a> </li> <li class="nav-item"> <button id="search-button" class="btn search-button">Search <div id="search-icon" class="icon-button search-icon"></div></button> </li> </ul> </div> </nav> </header> </div> <div class="row flex-grow-0 flex-shrink-1">  <div class="col px-0">   <div class="container-fluid banner-message"> ATT&CK v16 has been released! Check out the <a href='https://medium.com/mitre-attack/attack-v16-561c76af94cf'>blog post</a> for more information. </div> </div> </div> <div class="row flex-grow-1 flex-shrink-0">   <div class="sidebar nav sticky-top flex-column pr-0 pt-4 pb-3 pl-3" id="v-tab" role="tablist" aria-orientation="vertical"> <div class="resizer" id="resizer"></div>  <div id="sidebars"></div>  </div> <div class="tab-content col-xl-9 pt-4" id="v-tabContent"> <div class="tab-pane fade show active" id="v-attckmatrix" role="tabpanel" aria-labelledby="v-attckmatrix-tab"> <ol class="breadcrumb"> <li class="breadcrumb-item"><a href="/">Home</a></li> <li class="breadcrumb-item"><a href="/techniques/enterprise">Techniques</a></li> <li class="breadcrumb-item"><a href="/techniques/enterprise">Enterprise</a></li> <li class="breadcrumb-item">Native API</li> </ol> <div class="tab-pane fade show active" id="v-" role="tabpanel" aria-labelledby="v--tab"></div> <div class="row"> <div class="col-xl-12"> <div class="jumbotron jumbotron-fluid"> <div class="container-fluid"> <h1 id=""> Native API </h1> <div class="row"> <div class="col-md-8"> <div class="description-body"> Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.<a href="https://undocumented.ntinternals.net/" target="_blank" data-hasqtip="0" aria-describedby="qtip-0">[1]</a><span onclick=scrollToRef('scite-2') id="scite-ref-2-a" class="scite-citeref-number" title="Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020."data-reference="Linux Kernel API"><a href="https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html" target="_blank" data-hasqtip="1" aria-describedby="qtip-1">[2]</a> These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to <a href="/techniques/T1059">Command and Scripting Interpreter</a>, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.Native API functions (such as <code>NtCreateProcess</code>) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.<span onclick=scrollToRef('scite-3') id="scite-ref-3-a" class="scite-citeref-number" title="de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021."data-reference="OutFlank System Calls"><a href="https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/" target="_blank" data-hasqtip="2" aria-describedby="qtip-2">[3]</a><span onclick=scrollToRef('scite-4') id="scite-ref-4-a" class="scite-citeref-number" title="Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021."data-reference="CyberBit System Calls"><a href="https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/" target="_blank" data-hasqtip="3" aria-describedby="qtip-3">[4]</a><span onclick=scrollToRef('scite-5') id="scite-ref-5-a" class="scite-citeref-number" title="MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021."data-reference="MDSec System Calls"><a href="https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/" target="_blank" data-hasqtip="4" aria-describedby="qtip-4">[5]</a> For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.<a href="https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa" target="_blank" data-hasqtip="5" aria-describedby="qtip-5">[6]</a><span onclick=scrollToRef('scite-7') id="scite-ref-7-a" class="scite-citeref-number" title="Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020."data-reference="GNU Fork"><a href="https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html" target="_blank" data-hasqtip="6" aria-describedby="qtip-6">[7]</a> This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.<span onclick=scrollToRef('scite-8') id="scite-ref-8-a" class="scite-citeref-number" title="Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020."data-reference="Microsoft Win32"><a href="https://docs.microsoft.com/en-us/windows/win32/api/" target="_blank" data-hasqtip="7" aria-describedby="qtip-7">[8]</a><a href="https://man7.org/linux/man-pages//man7/libc.7.html" target="_blank" data-hasqtip="8" aria-describedby="qtip-8">[9]</a><span onclick=scrollToRef('scite-10') id="scite-ref-10-a" class="scite-citeref-number" title="glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020."data-reference="GLIBC"><a href="https://www.gnu.org/software/libc/" target="_blank" data-hasqtip="9" aria-describedby="qtip-9">[10]</a>Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.<a href="https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework" target="_blank" data-hasqtip="10" aria-describedby="qtip-10">[11]</a><a href="https://developer.apple.com/documentation/coreservices" target="_blank" data-hasqtip="11" aria-describedby="qtip-11">[12]</a><a href="https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1" target="_blank" data-hasqtip="12" aria-describedby="qtip-12">[13]</a><a href="https://developer.apple.com/documentation/foundation" target="_blank" data-hasqtip="13" aria-describedby="qtip-13">[14]</a>Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.<span onclick=scrollToRef('scite-15') id="scite-ref-15-a" class="scite-citeref-number" title="Feichter, D. (2023, June 30). Direct Syscalls vs Indirect Syscalls. Retrieved September 27, 2023."data-reference="Redops Syscalls"><a href="https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls" target="_blank" data-hasqtip="14" aria-describedby="qtip-14">[15]</a> Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via <a href="/techniques/T1562/001">Disable or Modify Tools</a>. </div> </div> <div class="col-md-4"> <div class="card"> <div class="card-body"> <div class="row card-data" id="card-id"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> ID: T1106 </div> </div>  <div class="row card-data"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> Sub-techniques:  No sub-techniques </div> </div>  <div id="card-tactics" class="row card-data"> <div class="col-md-1 px-0 text-center"> ⓘ </div> <div class="col-md-11 pl-0"> Tactic: <a href="/tactics/TA0002">Execution</a> </div> </div> <div class="row card-data"> <div class="col-md-1 px-0 text-center"> ⓘ </div> <div class="col-md-11 pl-0"> Platforms: Linux, Windows, macOS </div> </div> <div class="row card-data"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> Contributors: Gordon Long, Box, Inc., @ethicalhax; Stefan Kanthak; Tristan Madani (Cybereason) </div> </div> <div class="row card-data"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> Version: 2.2 </div> </div> <div class="row card-data"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> Created: 31 May 2017 </div> </div> <div class="row card-data"> <div class="col-md-1 px-0 text-center"></div> <div class="col-md-11 pl-0"> Last Modified: 12 September 2024 </div> </div> </div> </div> <div class="text-center pt-2 version-button live"> <div class="live"> <a data-toggle="tooltip" data-placement="bottom" title="Permalink to this version of T1106" href="/versions/v16/techniques/T1106/" data-test-ignore="true">Version Permalink</a> </div> <div class="permalink"> <a data-toggle="tooltip" data-placement="bottom" title="Go to the live version of T1106" href="/versions/v16/techniques/T1106/" data-test-ignore="true">Live Version</a> </div> </div> </div> </div> <h2 class="pt-3" id ="examples">Procedure Examples</h2> <div class="tables-mobile"> <table class="table table-bordered table-alternate mt-2"> <thead> <tr> <th scope="col">ID</th> <th scope="col">Name</th> <th scope="col">Description</th> </tr> </thead> <tbody> <tr> <td> <a href="/software/S0045"> S0045 </a> </td> <td> <a href="/software/S0045"> ADVSTORESHELL </a> </td> <td> <a href="/software/S0045">ADVSTORESHELL</a> is capable of starting a process using CreateProcess.<span onclick=scrollToRef('scite-16') id="scite-ref-16-a" class="scite-citeref-number" title="Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017."data-reference="Bitdefender APT28 Dec 2015"><a href="https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf" target="_blank" data-hasqtip="15" aria-describedby="qtip-15">[16]</a> </td> </tr> <tr> <td> <a href="/software/S1129"> S1129 </a> </td> <td> <a href="/software/S1129"> Akira </a> </td> <td> <a href="/software/S1129">Akira</a> executes native Windows functions such as <code>GetFileAttributesW</code> and <code>GetSystemInfo</code>.<span onclick=scrollToRef('scite-17') id="scite-ref-17-a" class="scite-citeref-number" title="Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024."data-reference="Kersten Akira 2023"><a href="https://www.trellix.com/blogs/research/akira-ransomware/" target="_blank" data-hasqtip="16" aria-describedby="qtip-16">[17]</a> </td> </tr> <tr> <td> <a href="/software/S1025"> S1025 </a> </td> <td> <a href="/software/S1025"> Amadey </a> </td> <td> <a href="/software/S1025">Amadey</a> has used a variety of Windows API calls, including <code>GetComputerNameA</code>, <code>GetUserNameA</code>, and <code>CreateProcessA</code>.<span onclick=scrollToRef('scite-18') id="scite-ref-18-a" class="scite-citeref-number" title="Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022."data-reference="BlackBerry Amadey 2020"><a href="https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot" target="_blank" data-hasqtip="17" aria-describedby="qtip-17">[18]</a> </td> </tr> <tr> <td> <a href="/software/S0622"> S0622 </a> </td> <td> <a href="/software/S0622"> AppleSeed </a> </td> <td> <a href="/software/S0622">AppleSeed</a> has the ability to use multiple dynamically resolved API calls.<span onclick=scrollToRef('scite-19') id="scite-ref-19-a" class="scite-citeref-number" title="Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021."data-reference="Malwarebytes Kimsuky June 2021"><a href="https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/" target="_blank" data-hasqtip="18" aria-describedby="qtip-18">[19]</a> </td> </tr> <tr> <td> <a href="/groups/G0067"> G0067 </a> </td> <td> <a href="/groups/G0067"> APT37 </a> </td> <td> <a href="/groups/G0067">APT37</a> leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.<span onclick=scrollToRef('scite-20') id="scite-ref-20-a" class="scite-citeref-number" title="Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018."data-reference="Talos Group123"><a href="https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html" target="_blank" data-hasqtip="19" aria-describedby="qtip-19">[20]</a> </td> </tr> <tr> <td> <a href="/groups/G0082"> G0082 </a> </td> <td> <a href="/groups/G0082"> APT38 </a> </td> <td> <a href="/groups/G0082">APT38</a> has used the Windows API to execute code within a victim's system.<span onclick=scrollToRef('scite-21') id="scite-ref-21-a" class="scite-citeref-number" title="DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021."data-reference="CISA AA20-239A BeagleBoyz August 2020"><a href="https://us-cert.cisa.gov/ncas/alerts/aa20-239a" target="_blank" data-hasqtip="20" aria-describedby="qtip-20">[21]</a> </td> </tr> <tr> <td> <a href="/software/S0456"> S0456 </a> </td> <td> <a href="/software/S0456"> Aria-body </a> </td> <td> <a href="/software/S0456">Aria-body</a> has the ability to launch files using <code>ShellExecute</code>.<span onclick=scrollToRef('scite-22') id="scite-ref-22-a" class="scite-citeref-number" title="CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020."data-reference="CheckPoint Naikon May 2020"><a href="https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/" target="_blank" data-hasqtip="21" aria-describedby="qtip-21">[22]</a> </td> </tr> <tr> <td> <a href="/software/S1087"> S1087 </a> </td> <td> <a href="/software/S1087"> AsyncRAT </a> </td> <td> <a href="/software/S1087">AsyncRAT</a> has the ability to use OS APIs including <code>CheckRemoteDebuggerPresent</code>.<span onclick=scrollToRef('scite-23') id="scite-ref-23-a" class="scite-citeref-number" title="Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023."data-reference="Telefonica Snip3 December 2021"><a href="https://telefonicatech.com/blog/snip3-investigacion-malware" target="_blank" data-hasqtip="22" aria-describedby="qtip-22">[23]</a> </td> </tr> <tr> <td> <a href="/software/S0438"> S0438 </a> </td> <td> <a href="/software/S0438"> Attor </a> </td> <td> <a href="/software/S0438">Attor</a>'s dispatcher has used CreateProcessW API for execution.<span onclick=scrollToRef('scite-24') id="scite-ref-24-a" class="scite-citeref-number" title="Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020."data-reference="ESET Attor Oct 2019"><a href="https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf" target="_blank" data-hasqtip="23" aria-describedby="qtip-23">[24]</a> </td> </tr> <tr> <td> <a href="/software/S0640"> S0640 </a> </td> <td> <a href="/software/S0640"> Avaddon </a> </td> <td> <a href="/software/S0640">Avaddon</a> has used the Windows Crypto API to generate an AES key.<span onclick=scrollToRef('scite-25') id="scite-ref-25-a" class="scite-citeref-number" title="Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021."data-reference="Hornet Security Avaddon June 2020"><a href="https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/" target="_blank" data-hasqtip="24" aria-describedby="qtip-24">[25]</a> </td> </tr> <tr> <td> <a href="/software/S1053"> S1053 </a> </td> <td> <a href="/software/S1053"> AvosLocker </a> </td> <td> <a href="/software/S1053">AvosLocker</a> has used a variety of Windows API calls, including <code>NtCurrentPeb</code> and <code>GetLogicalDrives</code>.<span onclick=scrollToRef('scite-26') id="scite-ref-26-a" class="scite-citeref-number" title="Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023."data-reference="Malwarebytes AvosLocker Jul 2021"><a href="https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners" target="_blank" data-hasqtip="25" aria-describedby="qtip-25">[26]</a> </td> </tr> <tr> <td> <a href="/software/S0638"> S0638 </a> </td> <td> <a href="/software/S0638"> Babuk </a> </td> <td> <a href="/software/S0638">Babuk</a> can use multiple Windows API calls for actions on compromised hosts including discovery and execution.<span onclick=scrollToRef('scite-27') id="scite-ref-27-a" class="scite-citeref-number" title="Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021."data-reference="Sogeti CERT ESEC Babuk March 2021"><a href="https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf" target="_blank" data-hasqtip="26" aria-describedby="qtip-26">[27]</a><span onclick=scrollToRef('scite-28') id="scite-ref-28-a" class="scite-citeref-number" title="Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021."data-reference="McAfee Babuk February 2021"><a href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf" target="_blank" data-hasqtip="27" aria-describedby="qtip-27">[28]</a><span onclick=scrollToRef('scite-29') id="scite-ref-29-a" class="scite-citeref-number" title="Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021."data-reference="Medium Babuk February 2021"><a href="https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62" target="_blank" data-hasqtip="28" aria-describedby="qtip-28">[29]</a> </td> </tr> <tr> <td> <a href="/software/S0475"> S0475 </a> </td> <td> <a href="/software/S0475"> BackConfig </a> </td> <td> <a href="/software/S0475">BackConfig</a> can leverage API functions such as <code>ShellExecuteA</code> and <code>HttpOpenRequestA</code> in the process of downloading and executing files.<span onclick=scrollToRef('scite-30') id="scite-ref-30-a" class="scite-citeref-number" title="Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020."data-reference="Unit 42 BackConfig May 2020"><a href="https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/" target="_blank" data-hasqtip="29" aria-describedby="qtip-29">[30]</a> </td> </tr> <tr> <td> <a href="/software/S0606"> S0606 </a> </td> <td> <a href="/software/S0606"> Bad Rabbit </a> </td> <td> <a href="/software/S0606">Bad Rabbit</a> has used various Windows API calls.<span onclick=scrollToRef('scite-31') id="scite-ref-31-a" class="scite-citeref-number" title="M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021."data-reference="ESET Bad Rabbit"><a href="https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/" target="_blank" data-hasqtip="30" aria-describedby="qtip-30">[31]</a> </td> </tr> <tr> <td> <a href="/software/S1081"> S1081 </a> </td> <td> <a href="/software/S1081"> BADHATCH </a> </td> <td> <a href="/software/S1081">BADHATCH</a> can utilize Native API functions such as, <code>ToolHelp32</code> and <code>Rt1AdjustPrivilege</code> to enable <code>SeDebugPrivilege</code> on a compromised machine.<span onclick=scrollToRef('scite-32') id="scite-ref-32-a" class="scite-citeref-number" title="Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021."data-reference="Gigamon BADHATCH Jul 2019"><a href="https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/" target="_blank" data-hasqtip="31" aria-describedby="qtip-31">[32]</a> </td> </tr> <tr> <td> <a href="/software/S0128"> S0128 </a> </td> <td> <a href="/software/S0128"> BADNEWS </a> </td> <td> <a href="/software/S0128">BADNEWS</a> has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.<span onclick=scrollToRef('scite-33') id="scite-ref-33-a" class="scite-citeref-number" title="Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016."data-reference="Forcepoint Monsoon"><a href="https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf" target="_blank" data-hasqtip="32" aria-describedby="qtip-32">[33]</a><span onclick=scrollToRef('scite-34') id="scite-ref-34-a" class="scite-citeref-number" title="Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018."data-reference="TrendMicro Patchwork Dec 2017"><a href="https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf" target="_blank" data-hasqtip="33" aria-describedby="qtip-33">[34]</a> </td> </tr> <tr> <td> <a href="/software/S0234"> S0234 </a> </td> <td> <a href="/software/S0234"> Bandook </a> </td> <td> <a href="/software/S0234">Bandook</a> has used the ShellExecuteW() function call.<span onclick=scrollToRef('scite-35') id="scite-ref-35-a" class="scite-citeref-number" title="Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021."data-reference="CheckPoint Bandook Nov 2020"><a href="https://research.checkpoint.com/2020/bandook-signed-delivered/" target="_blank" data-hasqtip="34" aria-describedby="qtip-34">[35]</a> </td> </tr> <tr> <td> <a href="/software/S0239"> S0239 </a> </td> <td> <a href="/software/S0239"> Bankshot </a> </td> <td> <a href="/software/S0239">Bankshot</a> creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().<span onclick=scrollToRef('scite-36') id="scite-ref-36-a" class="scite-citeref-number" title="Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018."data-reference="McAfee Bankshot"><a href="https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/" target="_blank" data-hasqtip="35" aria-describedby="qtip-35">[36]</a> </td> </tr> <tr> <td> <a href="/software/S0534"> S0534 </a> </td> <td> <a href="/software/S0534"> Bazar </a> </td> <td> <a href="/software/S0534">Bazar</a> can use various APIs to allocate memory and facilitate code execution/injection.<span onclick=scrollToRef('scite-37') id="scite-ref-37-a" class="scite-citeref-number" title="Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020."data-reference="Cybereason Bazar July 2020"><a href="https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles" target="_blank" data-hasqtip="36" aria-describedby="qtip-36">[37]</a> </td> </tr> <tr> <td> <a href="/software/S0470"> S0470 </a> </td> <td> <a href="/software/S0470"> BBK </a> </td> <td> <a href="/software/S0470">BBK</a> has the ability to use the <code>CreatePipe</code> API to add a sub-process for execution via <a href="/software/S0106">cmd</a>.<span onclick=scrollToRef('scite-38') id="scite-ref-38-a" class="scite-citeref-number" title="Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020."data-reference="Trend Micro Tick November 2019"><a href="https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" target="_blank" data-hasqtip="37" aria-describedby="qtip-37">[38]</a> </td> </tr> <tr> <td> <a href="/software/S0574"> S0574 </a> </td> <td> <a href="/software/S0574"> BendyBear </a> </td> <td> <a href="/software/S0574">BendyBear</a> can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.<span onclick=scrollToRef('scite-39') id="scite-ref-39-a" class="scite-citeref-number" title="Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021."data-reference="Unit42 BendyBear Feb 2021"><a href="https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/" target="_blank" data-hasqtip="38" aria-describedby="qtip-38">[39]</a> </td> </tr> <tr> <td> <a href="/software/S0268"> S0268 </a> </td> <td> <a href="/software/S0268"> Bisonal </a> </td> <td> <a href="/software/S0268">Bisonal</a> has used the Windows API to communicate with the Service Control Manager to execute a thread.<span onclick=scrollToRef('scite-40') id="scite-ref-40-a" class="scite-citeref-number" title="Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022."data-reference="Talos Bisonal Mar 2020"><a href="https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html" target="_blank" data-hasqtip="39" aria-describedby="qtip-39">[40]</a> </td> </tr> <tr> <td> <a href="/software/S0570"> S0570 </a> </td> <td> <a href="/software/S0570"> BitPaymer </a> </td> <td> <a href="/software/S0570">BitPaymer</a> has used dynamic API resolution to avoid identifiable strings within the binary, including <code>RegEnumKeyW</code>.<span onclick=scrollToRef('scite-41') id="scite-ref-41-a" class="scite-citeref-number" title="Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021."data-reference="Crowdstrike Indrik November 2018"><a href="https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/" target="_blank" data-hasqtip="40" aria-describedby="qtip-40">[41]</a> </td> </tr> <tr> <td> <a href="/software/S1070"> S1070 </a> </td> <td> <a href="/software/S1070"> Black Basta </a> </td> <td> <a href="/software/S1070">Black Basta</a> has the ability to use native APIs for numerous functions including discovery and defense evasion.<span onclick=scrollToRef('scite-42') id="scite-ref-42-a" class="scite-citeref-number" title="Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023."data-reference="Minerva Labs Black Basta May 2022"><a href="https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/" target="_blank" data-hasqtip="41" aria-describedby="qtip-41">[42]</a><span onclick=scrollToRef('scite-43') id="scite-ref-43-a" class="scite-citeref-number" title="Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved March 7, 2023."data-reference="Cyble Black Basta May 2022"><a href="https://blog.cyble.com/2022/05/06/black-basta-ransomware/" target="_blank" data-hasqtip="42" aria-describedby="qtip-42">[43]</a><span onclick=scrollToRef('scite-44') id="scite-ref-44-a" class="scite-citeref-number" title="Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023."data-reference="Avertium Black Basta June 2022"><a href="https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware" target="_blank" data-hasqtip="43" aria-describedby="qtip-43">[44]</a><span onclick=scrollToRef('scite-45') id="scite-ref-45-a" class="scite-citeref-number" title="Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023."data-reference="Check Point Black Basta October 2022"><a href="https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/" target="_blank" data-hasqtip="44" aria-describedby="qtip-44">[45]</a> </td> </tr> <tr> <td> <a href="/groups/G0098"> G0098 </a> </td> <td> <a href="/groups/G0098"> BlackTech </a> </td> <td> <a href="/groups/G0098">BlackTech</a> has used built-in API functions.<span onclick=scrollToRef('scite-46') id="scite-ref-46-a" class="scite-citeref-number" title="Demboski, M., et al. (2021, October 26). China cyber attacks: the current threat landscape. Retrieved March 25, 2022."data-reference="IronNet BlackTech Oct 2021"><a href="https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape" target="_blank" data-hasqtip="45" aria-describedby="qtip-45">[46]</a> </td> </tr> <tr> <td> <a href="/software/S0521"> S0521 </a> </td> <td> <a href="/software/S0521"> BloodHound </a> </td> <td> <a href="/software/S0521">BloodHound</a> can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.<span onclick=scrollToRef('scite-47') id="scite-ref-47-a" class="scite-citeref-number" title="Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019."data-reference="GitHub Bloodhound"><a href="https://github.com/BloodHoundAD/BloodHound" target="_blank" data-hasqtip="46" aria-describedby="qtip-46">[47]</a> </td> </tr> <tr> <td> <a href="/software/S0651"> S0651 </a> </td> <td> <a href="/software/S0651"> BoxCaon </a> </td> <td> <a href="/software/S0651">BoxCaon</a> has used Windows API calls to obtain information about the compromised host.<span onclick=scrollToRef('scite-48') id="scite-ref-48-a" class="scite-citeref-number" title="CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021."data-reference="Checkpoint IndigoZebra July 2021"><a href="https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/" target="_blank" data-hasqtip="47" aria-describedby="qtip-47">[48]</a> </td> </tr> <tr> <td> <a href="/software/S1063"> S1063 </a> </td> <td> <a href="/software/S1063"> Brute Ratel C4 </a> </td> <td> <a href="/software/S1063">Brute Ratel C4</a> can call multiple Windows APIs for execution, to share memory, and defense evasion.<span onclick=scrollToRef('scite-49') id="scite-ref-49-a" class="scite-citeref-number" title="Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023."data-reference="Palo Alto Brute Ratel July 2022"><a href="https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/" target="_blank" data-hasqtip="48" aria-describedby="qtip-48">[49]</a><span onclick=scrollToRef('scite-50') id="scite-ref-50-a" class="scite-citeref-number" title="Chell, D. PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023."data-reference="MDSec Brute Ratel August 2022"><a href="https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/" target="_blank" data-hasqtip="49" aria-describedby="qtip-49">[50]</a> </td> </tr> <tr> <td> <a href="/software/S0471"> S0471 </a> </td> <td> <a href="/software/S0471"> build_downer </a> </td> <td> <a href="/software/S0471">build_downer</a> has the ability to use the <code>WinExec</code> API to execute malware on a compromised host.<span onclick=scrollToRef('scite-38') id="scite-ref-38-a" class="scite-citeref-number" title="Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020."data-reference="Trend Micro Tick November 2019"><a href="https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" target="_blank" data-hasqtip="37" aria-describedby="qtip-37">[38]</a> </td> </tr> <tr> <td> <a href="/software/S1039"> S1039 </a> </td> <td> <a href="/software/S1039"> Bumblebee </a> </td> <td> <a href="/software/S1039">Bumblebee</a> can use multiple Native APIs.<span onclick=scrollToRef('scite-51') id="scite-ref-51-a" class="scite-citeref-number" title="Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022."data-reference="Proofpoint Bumblebee April 2022"><a href="https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming" target="_blank" data-hasqtip="50" aria-describedby="qtip-50">[51]</a><span onclick=scrollToRef('scite-52') id="scite-ref-52-a" class="scite-citeref-number" title="Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022."data-reference="Medium Ali Salem Bumblebee April 2022"><a href="https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056" target="_blank" data-hasqtip="51" aria-describedby="qtip-51">[52]</a> </td> </tr> <tr> <td> <a href="/software/S0693"> S0693 </a> </td> <td> <a href="/software/S0693"> CaddyWiper </a> </td> <td> <a href="/software/S0693">CaddyWiper</a> has the ability to dynamically resolve and use APIs, including <code>SeTakeOwnershipPrivilege</code>.<span onclick=scrollToRef('scite-53') id="scite-ref-53-a" class="scite-citeref-number" title="Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022."data-reference="Cisco CaddyWiper March 2022"><a href="https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html" target="_blank" data-hasqtip="52" aria-describedby="qtip-52">[53]</a> </td> </tr> <tr> <td> <a href="/software/S0484"> S0484 </a> </td> <td> <a href="/software/S0484"> Carberp </a> </td> <td> <a href="/software/S0484">Carberp</a> has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.<span onclick=scrollToRef('scite-54') id="scite-ref-54-a" class="scite-citeref-number" title="Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020."data-reference="Trusteer Carberp October 2010"><a href="https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf" target="_blank" data-hasqtip="53" aria-describedby="qtip-53">[54]</a> </td> </tr> <tr> <td> <a href="/software/S0631"> S0631 </a> </td> <td> <a href="/software/S0631"> Chaes </a> </td> <td> <a href="/software/S0631">Chaes</a> used the <code>CreateFileW()</code> API function with read permissions to access downloaded payloads.<span onclick=scrollToRef('scite-55') id="scite-ref-55-a" class="scite-citeref-number" title="Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021."data-reference="Cybereason Chaes Nov 2020"><a href="https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf" target="_blank" data-hasqtip="54" aria-describedby="qtip-54">[55]</a> </td> </tr> <tr> <td> <a href="/groups/G0114"> G0114 </a> </td> <td> <a href="/groups/G0114"> Chimera </a> </td> <td> <a href="/groups/G0114">Chimera</a> has used direct Windows system calls by leveraging Dumpert.<span onclick=scrollToRef('scite-56') id="scite-ref-56-a" class="scite-citeref-number" title="Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.."data-reference="Cycraft Chimera April 2020"><a href="https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf" target="_blank" data-hasqtip="55" aria-describedby="qtip-55">[56]</a> </td> </tr> <tr> <td> <a href="/software/S1149"> S1149 </a> </td> <td> <a href="/software/S1149"> CHIMNEYSWEEP </a> </td> <td> <a href="/software/S1149">CHIMNEYSWEEP</a> can use Windows APIs including <code>LoadLibrary</code> and <code>GetProcAddress</code>.<span onclick=scrollToRef('scite-57') id="scite-ref-57-a" class="scite-citeref-number" title="Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024."data-reference="Mandiant ROADSWEEP August 2022"><a href="https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/" target="_blank" data-hasqtip="56" aria-describedby="qtip-56">[57]</a> </td> </tr> <tr> <td> <a href="/software/S0667"> S0667 </a> </td> <td> <a href="/software/S0667"> Chrommme </a> </td> <td> <a href="/software/S0667">Chrommme</a> can use Windows API including <code>WinExec</code> for execution.<span onclick=scrollToRef('scite-58') id="scite-ref-58-a" class="scite-citeref-number" title="Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021."data-reference="ESET Gelsemium June 2021"><a href="https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf" target="_blank" data-hasqtip="57" aria-describedby="qtip-57">[58]</a> </td> </tr> <tr> <td> <a href="/software/S0611"> S0611 </a> </td> <td> <a href="/software/S0611"> Clop </a> </td> <td> <a href="/software/S0611">Clop</a> has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().<a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/" target="_blank" data-hasqtip="58" aria-describedby="qtip-58">[59]</a><span onclick=scrollToRef('scite-60') id="scite-ref-60-a" class="scite-citeref-number" title="Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021."data-reference="Cybereason Clop Dec 2020"><a href="https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware" target="_blank" data-hasqtip="59" aria-describedby="qtip-59">[60]</a> </td> </tr> <tr> <td> <a href="/software/S0154"> S0154 </a> </td> <td> <a href="/software/S0154"> Cobalt Strike </a> </td> <td> <a href="/software/S0154">Cobalt Strike</a>'s Beacon payload is capable of running shell commands without <code>cmd.exe</code> and PowerShell commands without <code>powershell.exe</code><span onclick=scrollToRef('scite-61') id="scite-ref-61-a" class="scite-citeref-number" title="Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017."data-reference="cobaltstrike manual"><a href="https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf" target="_blank" data-hasqtip="60" aria-describedby="qtip-60">[61]</a><span onclick=scrollToRef('scite-62') id="scite-ref-62-a" class="scite-citeref-number" title="Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024."data-reference="Talos Cobalt Strike September 2020"><a href="https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf" target="_blank" data-hasqtip="61" aria-describedby="qtip-61">[62]</a><span onclick=scrollToRef('scite-63') id="scite-ref-63-a" class="scite-citeref-number" title="Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021."data-reference="Cobalt Strike Manual 4.3 November 2020"><a href="https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf" target="_blank" data-hasqtip="62" aria-describedby="qtip-62">[63]</a> </td> </tr> <tr> <td> <a href="/software/S0126"> S0126 </a> </td> <td> <a href="/software/S0126"> ComRAT </a> </td> <td> <a href="/software/S0126">ComRAT</a> can load a PE file from memory or the file system and execute it with <code>CreateProcessW</code>.<span onclick=scrollToRef('scite-64') id="scite-ref-64-a" class="scite-citeref-number" title="Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020."data-reference="ESET ComRAT May 2020"><a href="https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf" target="_blank" data-hasqtip="63" aria-describedby="qtip-63">[64]</a> </td> </tr> <tr> <td> <a href="/software/S0575"> S0575 </a> </td> <td> <a href="/software/S0575"> Conti </a> </td> <td> <a href="/software/S0575">Conti</a> has used API calls during execution.<span onclick=scrollToRef('scite-65') id="scite-ref-65-a" class="scite-citeref-number" title="Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021."data-reference="Cybereason Conti Jan 2021"><a href="https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware" target="_blank" data-hasqtip="64" aria-describedby="qtip-64">[65]</a><span onclick=scrollToRef('scite-66') id="scite-ref-66-a" class="scite-citeref-number" title="Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021."data-reference="CarbonBlack Conti July 2020"><a href="https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/" target="_blank" data-hasqtip="65" aria-describedby="qtip-65">[66]</a> </td> </tr> <tr> <td> <a href="/software/S0614"> S0614 </a> </td> <td> <a href="/software/S0614"> CostaBricks </a> </td> <td> <a href="/software/S0614">CostaBricks</a> has used a number of API calls, including <code>VirtualAlloc</code>, <code>VirtualFree</code>, <code>LoadLibraryA</code>, <code>GetProcAddress</code>, and <code>ExitProcess</code>.<span onclick=scrollToRef('scite-67') id="scite-ref-67-a" class="scite-citeref-number" title="The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021."data-reference="BlackBerry CostaRicto November 2020"><a href="https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced" target="_blank" data-hasqtip="66" aria-describedby="qtip-66">[67]</a> </td> </tr> <tr> <td> <a href="/software/S0625"> S0625 </a> </td> <td> <a href="/software/S0625"> Cuba </a> </td> <td> <a href="/software/S0625">Cuba</a> has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.<span onclick=scrollToRef('scite-68') id="scite-ref-68-a" class="scite-citeref-number" title="Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021."data-reference="McAfee Cuba April 2021"><a href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf" target="_blank" data-hasqtip="67" aria-describedby="qtip-67">[68]</a> </td> </tr> <tr> <td> <a href="/software/S0687"> S0687 </a> </td> <td> <a href="/software/S0687"> Cyclops Blink </a> </td> <td> <a href="/software/S0687">Cyclops Blink</a> can use various Linux API functions including those for execution and discovery.<span onclick=scrollToRef('scite-69') id="scite-ref-69-a" class="scite-citeref-number" title="NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022."data-reference="NCSC Cyclops Blink February 2022"><a href="https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf" target="_blank" data-hasqtip="68" aria-describedby="qtip-68">[69]</a> </td> </tr> <tr> <td> <a href="/software/S1111"> S1111 </a> </td> <td> <a href="/software/S1111"> DarkGate </a> </td> <td> <a href="/software/S1111">DarkGate</a> uses the native Windows API <code>CallWindowProc()</code> to decode and launch encoded shellcode payloads during execution.<span onclick=scrollToRef('scite-70') id="scite-ref-70-a" class="scite-citeref-number" title="Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024."data-reference="Trellix Darkgate 2023"><a href="https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/" target="_blank" data-hasqtip="69" aria-describedby="qtip-69">[70]</a> <a href="/software/S1111">DarkGate</a> can call kernel mode functions directly to hide the use of process hollowing methods during execution.<span onclick=scrollToRef('scite-71') id="scite-ref-71-a" class="scite-citeref-number" title="Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024."data-reference="Ensilo Darkgate 2018"><a href="https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign" target="_blank" data-hasqtip="70" aria-describedby="qtip-70">[71]</a> </td> </tr> <tr> <td> <a href="/software/S1066"> S1066 </a> </td> <td> <a href="/software/S1066"> DarkTortilla </a> </td> <td> <a href="/software/S1066">DarkTortilla</a> can use a variety of API calls for persistence and defense evasion.<span onclick=scrollToRef('scite-72') id="scite-ref-72-a" class="scite-citeref-number" title="Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022."data-reference="Secureworks DarkTortilla Aug 2022"><a href="https://www.secureworks.com/research/darktortilla-malware-analysis" target="_blank" data-hasqtip="71" aria-describedby="qtip-71">[72]</a> </td> </tr> <tr> <td> <a href="/software/S1033"> S1033 </a> </td> <td> <a href="/software/S1033"> DCSrv </a> </td> <td> <a href="/software/S1033">DCSrv</a> has used various Windows API functions, including <code>DeviceIoControl</code>, as part of its encryption process.<span onclick=scrollToRef('scite-73') id="scite-ref-73-a" class="scite-citeref-number" title="Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022."data-reference="Checkpoint MosesStaff Nov 2021"><a href="https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/" target="_blank" data-hasqtip="72" aria-describedby="qtip-72">[73]</a> </td> </tr> <tr> <td> <a href="/software/S1052"> S1052 </a> </td> <td> <a href="/software/S1052"> DEADEYE </a> </td> <td> <a href="/software/S1052">DEADEYE</a> can execute the <code>GetComputerNameA</code> and <code>GetComputerNameExA</code> WinAPI functions.<span onclick=scrollToRef('scite-74') id="scite-ref-74-a" class="scite-citeref-number" title="Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022."data-reference="Mandiant APT41"><a href="https://www.mandiant.com/resources/apt41-us-state-governments" target="_blank" data-hasqtip="73" aria-describedby="qtip-73">[74]</a> </td> </tr> <tr> <td> <a href="/software/S0354"> S0354 </a> </td> <td> <a href="/software/S0354"> Denis </a> </td> <td> <a href="/software/S0354">Denis</a> used the <code>IsDebuggerPresent</code>, <code>OutputDebugString</code>, and <code>SetLastError</code> APIs to avoid debugging. <a href="/software/S0354">Denis</a> used <code>GetProcAddress</code> and <code>LoadLibrary</code> to dynamically resolve APIs. <a href="/software/S0354">Denis</a> also used the <code>Wow64SetThreadContext</code> API as part of a process hollowing process.<span onclick=scrollToRef('scite-75') id="scite-ref-75-a" class="scite-citeref-number" title="Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018."data-reference="Cybereason Cobalt Kitty 2017"><a href="https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" target="_blank" data-hasqtip="74" aria-describedby="qtip-74">[75]</a> </td> </tr> <tr> <td> <a href="/software/S0659"> S0659 </a> </td> <td> <a href="/software/S0659"> Diavol </a> </td> <td> <a href="/software/S0659">Diavol</a> has used several API calls like <code>GetLogicalDriveStrings</code>, <code>SleepEx</code>, <code>SystemParametersInfoAPI</code>, <code>CryptEncrypt</code>, and others to execute parts of its attack.<span onclick=scrollToRef('scite-76') id="scite-ref-76-a" class="scite-citeref-number" title="Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021."data-reference="Fortinet Diavol July 2021"><a href="https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider" target="_blank" data-hasqtip="75" aria-describedby="qtip-75">[76]</a> </td> </tr> <tr> <td> <a href="/software/S0695"> S0695 </a> </td> <td> <a href="/software/S0695"> Donut </a> </td> <td> <a href="/software/S0695">Donut</a> code modules use various API functions to load and inject code.<a href="https://github.com/TheWover/donut" target="_blank" data-hasqtip="76" aria-describedby="qtip-76">[77]</a> </td> </tr> <tr> <td> <a href="/software/S0694"> S0694 </a> </td> <td> <a href="/software/S0694"> DRATzarus </a> </td> <td> <a href="/software/S0694">DRATzarus</a> can use various API calls to see if it is running in a sandbox.<span onclick=scrollToRef('scite-78') id="scite-ref-78-a" class="scite-citeref-number" title="ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021."data-reference="ClearSky Lazarus Aug 2020"><a href="https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf" target="_blank" data-hasqtip="77" aria-describedby="qtip-77">[78]</a> </td> </tr> <tr> <td> <a href="/software/S0384"> S0384 </a> </td> <td> <a href="/software/S0384"> Dridex </a> </td> <td> <a href="/software/S0384">Dridex</a> has used the <code>OutputDebugStringW</code> function to avoid malware analysis as part of its anti-debugging technique.<span onclick=scrollToRef('scite-79') id="scite-ref-79-a" class="scite-citeref-number" title="Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021."data-reference="Checkpoint Dridex Jan 2021"><a href="https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/" target="_blank" data-hasqtip="78" aria-describedby="qtip-78">[79]</a> </td> </tr> <tr> <td> <a href="/software/S0554"> S0554 </a> </td> <td> <a href="/software/S0554"> Egregor </a> </td> <td> <a href="/software/S0554">Egregor</a> has used the Windows API to make detection more difficult.<span onclick=scrollToRef('scite-80') id="scite-ref-80-a" class="scite-citeref-number" title="Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020."data-reference="Cyble Egregor Oct 2020"><a href="https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/" target="_blank" data-hasqtip="79" aria-describedby="qtip-79">[80]</a> </td> </tr> <tr> <td> <a href="/software/S0367"> S0367 </a> </td> <td> <a href="/software/S0367"> Emotet </a> </td> <td> <a href="/software/S0367">Emotet</a> has used <code>CreateProcess</code> to create a new process to run its executable and <code>WNetEnumResourceW</code> to enumerate non-hidden shares.<span onclick=scrollToRef('scite-81') id="scite-ref-81-a" class="scite-citeref-number" title="Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023."data-reference="Binary Defense Emotes Wi-Fi Spreader"><a href="https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/" target="_blank" data-hasqtip="80" aria-describedby="qtip-80">[81]</a> </td> </tr> <tr> <td> <a href="/software/S0363"> S0363 </a> </td> <td> <a href="/software/S0363"> Empire </a> </td> <td> <a href="/software/S0363">Empire</a> contains a variety of enumeration modules that have an option to use API calls to carry out tasks.<span onclick=scrollToRef('scite-82') id="scite-ref-82-a" class="scite-citeref-number" title="Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016."data-reference="Github PowerShell Empire"><a href="https://github.com/PowerShellEmpire/Empire" target="_blank" data-hasqtip="81" aria-describedby="qtip-81">[82]</a> </td> </tr> <tr> <td> <a href="/software/S0396"> S0396 </a> </td> <td> <a href="/software/S0396"> EvilBunny </a> </td> <td> <a href="/software/S0396">EvilBunny</a> has used various API calls as part of its checks to see if the malware is running in a sandbox.<span onclick=scrollToRef('scite-83') id="scite-ref-83-a" class="scite-citeref-number" title="Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019."data-reference="Cyphort EvilBunny Dec 2014"><a href="https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/" target="_blank" data-hasqtip="82" aria-describedby="qtip-82">[83]</a> </td> </tr> <tr> <td> <a href="/software/S0569"> S0569 </a> </td> <td> <a href="/software/S0569"> Explosive </a> </td> <td> <a href="/software/S0569">Explosive</a> has a function to call the OpenClipboard wrapper.<span onclick=scrollToRef('scite-84') id="scite-ref-84-a" class="scite-citeref-number" title="Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021."data-reference="CheckPoint Volatile Cedar March 2015"><a href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf" target="_blank" data-hasqtip="83" aria-describedby="qtip-83">[84]</a> </td> </tr> <tr> <td> <a href="/software/S0512"> S0512 </a> </td> <td> <a href="/software/S0512"> FatDuke </a> </td> <td> <a href="/software/S0512">FatDuke</a> can call <code>ShellExecuteW</code> to open the default browser on the URL localhost.<span onclick=scrollToRef('scite-85') id="scite-ref-85-a" class="scite-citeref-number" title="Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020."data-reference="ESET Dukes October 2019"><a href="https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" target="_blank" data-hasqtip="84" aria-describedby="qtip-84">[85]</a> </td> </tr> <tr> <td> <a href="/software/S0696"> S0696 </a> </td> <td> <a href="/software/S0696"> Flagpro </a> </td> <td> <a href="/software/S0696">Flagpro</a> can use Native API to enable obfuscation including <code>GetLastError</code> and <code>GetTickCount</code>.<span onclick=scrollToRef('scite-86') id="scite-ref-86-a" class="scite-citeref-number" title="Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022."data-reference="NTT Security Flagpro new December 2021"><a href="https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech" target="_blank" data-hasqtip="85" aria-describedby="qtip-85">[86]</a> </td> </tr> <tr> <td> <a href="/software/S0661"> S0661 </a> </td> <td> <a href="/software/S0661"> FoggyWeb </a> </td> <td> <a href="/software/S0661">FoggyWeb</a>'s loader can use API functions to load the <a href="/software/S0661">FoggyWeb</a> backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.<span onclick=scrollToRef('scite-87') id="scite-ref-87-a" class="scite-citeref-number" title="Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021."data-reference="MSTIC FoggyWeb September 2021"><a href="https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/" target="_blank" data-hasqtip="86" aria-describedby="qtip-86">[87]</a> </td> </tr> <tr> <td> <a href="/software/S1044"> S1044 </a> </td> <td> <a href="/software/S1044"> FunnyDream </a> </td> <td> <a href="/software/S1044">FunnyDream</a> can use Native API for defense evasion, discovery, and collection.<span onclick=scrollToRef('scite-88') id="scite-ref-88-a" class="scite-citeref-number" title="Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022."data-reference="Bitdefender FunnyDream Campaign November 2020"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" target="_blank" data-hasqtip="87" aria-describedby="qtip-87">[88]</a> </td> </tr> <tr> <td> <a href="/groups/G0047"> G0047 </a> </td> <td> <a href="/groups/G0047"> Gamaredon Group </a> </td> <td> <a href="/groups/G0047">Gamaredon Group</a> malware has used <code>CreateProcess</code> to launch additional malicious components.<span onclick=scrollToRef('scite-89') id="scite-ref-89-a" class="scite-citeref-number" title="Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020."data-reference="ESET Gamaredon June 2020"><a href="https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/" target="_blank" data-hasqtip="88" aria-describedby="qtip-88">[89]</a> </td> </tr> <tr> <td> <a href="/software/S0666"> S0666 </a> </td> <td> <a href="/software/S0666"> Gelsemium </a> </td> <td> <a href="/software/S0666">Gelsemium</a> has the ability to use various Windows API functions to perform tasks.<span onclick=scrollToRef('scite-58') id="scite-ref-58-a" class="scite-citeref-number" title="Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021."data-reference="ESET Gelsemium June 2021"><a href="https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf" target="_blank" data-hasqtip="57" aria-describedby="qtip-57">[58]</a> </td> </tr> <tr> <td> <a href="/software/S0032"> S0032 </a> </td> <td> <a href="/software/S0032"> gh0st RAT </a> </td> <td> <a href="/software/S0032">gh0st RAT</a> has used the <code>InterlockedExchange</code>, <code>SeShutdownPrivilege</code>, and <code>ExitWindowsEx</code> Windows API functions.<span onclick=scrollToRef('scite-90') id="scite-ref-90-a" class="scite-citeref-number" title="Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020."data-reference="Gh0stRAT ATT March 2019"><a href="https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" target="_blank" data-hasqtip="89" aria-describedby="qtip-89">[90]</a> </td> </tr> <tr> <td> <a href="/software/S0493"> S0493 </a> </td> <td> <a href="/software/S0493"> GoldenSpy </a> </td> <td> <a href="/software/S0493">GoldenSpy</a> can execute remote commands in the Windows command shell using the <code>WinExec()</code> API.<span onclick=scrollToRef('scite-91') id="scite-ref-91-a" class="scite-citeref-number" title="Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020."data-reference="Trustwave GoldenSpy June 2020"><a href="https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/" target="_blank" data-hasqtip="90" aria-describedby="qtip-90">[91]</a> </td> </tr> <tr> <td> <a href="/software/S0477"> S0477 </a> </td> <td> <a href="/software/S0477"> Goopy </a> </td> <td> <a href="/software/S0477">Goopy</a> has the ability to enumerate the infected system's user name via <code>GetUserNameW</code>.<span onclick=scrollToRef('scite-75') id="scite-ref-75-a" class="scite-citeref-number" title="Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018."data-reference="Cybereason Cobalt Kitty 2017"><a href="https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" target="_blank" data-hasqtip="74" aria-describedby="qtip-74">[75]</a> </td> </tr> <tr> <td> <a href="/groups/G0078"> G0078 </a> </td> <td> <a href="/groups/G0078"> Gorgon Group </a> </td> <td> <a href="/groups/G0078">Gorgon Group</a> malware can leverage the Windows API call, CreateProcessA(), for execution.<span onclick=scrollToRef('scite-92') id="scite-ref-92-a" class="scite-citeref-number" title="Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018."data-reference="Unit 42 Gorgon Group Aug 2018"><a href="https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/" target="_blank" data-hasqtip="91" aria-describedby="qtip-91">[92]</a> </td> </tr> <tr> <td> <a href="/software/S0531"> S0531 </a> </td> <td> <a href="/software/S0531"> Grandoreiro </a> </td> <td> <a href="/software/S0531">Grandoreiro</a> can execute through the <code>WinExec</code> API.<span onclick=scrollToRef('scite-93') id="scite-ref-93-a" class="scite-citeref-number" title="ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020."data-reference="ESET Grandoreiro April 2020"><a href="https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/" target="_blank" data-hasqtip="92" aria-describedby="qtip-92">[93]</a> </td> </tr> <tr> <td> <a href="/software/S0632"> S0632 </a> </td> <td> <a href="/software/S0632"> GrimAgent </a> </td> <td> <a href="/software/S0632">GrimAgent</a> can use Native API including <code>GetProcAddress</code> and <code>ShellExecuteW</code>.<span onclick=scrollToRef('scite-94') id="scite-ref-94-a" class="scite-citeref-number" title="Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024."data-reference="Group IB GrimAgent July 2021"><a href="https://www.group-ib.com/blog/grimagent/" target="_blank" data-hasqtip="93" aria-describedby="qtip-93">[94]</a> </td> </tr> <tr> <td> <a href="/software/S0561"> S0561 </a> </td> <td> <a href="/software/S0561"> GuLoader </a> </td> <td> <a href="/software/S0561">GuLoader</a> can use a number of different APIs for discovery and execution.<span onclick=scrollToRef('scite-95') id="scite-ref-95-a" class="scite-citeref-number" title="Salem, E. (2021, April 19). Dancing With Shellcodes: Cracking the latest version of Guloader. Retrieved July 7, 2021."data-reference="Medium Eli Salem GuLoader April 2021"><a href="https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4" target="_blank" data-hasqtip="94" aria-describedby="qtip-94">[95]</a> </td> </tr> <tr> <td> <a href="/software/S0499"> S0499 </a> </td> <td> <a href="/software/S0499"> Hancitor </a> </td> <td> <a href="/software/S0499">Hancitor</a> has used <code>CallWindowProc</code> and <code>EnumResourceTypesA</code> to interpret and execute shellcode.<span onclick=scrollToRef('scite-96') id="scite-ref-96-a" class="scite-citeref-number" title="Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020."data-reference="FireEye Hancitor"><a href="https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html" target="_blank" data-hasqtip="95" aria-describedby="qtip-95">[96]</a> </td> </tr> <tr> <td> <a href="/software/S0391"> S0391 </a> </td> <td> <a href="/software/S0391"> HAWKBALL </a> </td> <td> <a href="/software/S0391">HAWKBALL</a> has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.<span onclick=scrollToRef('scite-97') id="scite-ref-97-a" class="scite-citeref-number" title="Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019."data-reference="FireEye HAWKBALL Jun 2019"><a href="https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html" target="_blank" data-hasqtip="96" aria-describedby="qtip-96">[97]</a> </td> </tr> <tr> <td> <a href="/software/S0697"> S0697 </a> </td> <td> <a href="/software/S0697"> HermeticWiper </a> </td> <td> <a href="/software/S0697">HermeticWiper</a> can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.<span onclick=scrollToRef('scite-98') id="scite-ref-98-a" class="scite-citeref-number" title="Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022."data-reference="SentinelOne Hermetic Wiper February 2022"><a href="https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack" target="_blank" data-hasqtip="97" aria-describedby="qtip-97">[98]</a><span onclick=scrollToRef('scite-99') id="scite-ref-99-a" class="scite-citeref-number" title="Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022."data-reference="Crowdstrike DriveSlayer February 2022"><a href="https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/" target="_blank" data-hasqtip="98" aria-describedby="qtip-98">[99]</a><span onclick=scrollToRef('scite-100') id="scite-ref-100-a" class="scite-citeref-number" title="ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022."data-reference="ESET Hermetic Wizard March 2022"><a href="https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine" target="_blank" data-hasqtip="99" aria-describedby="qtip-99">[100]</a><span onclick=scrollToRef('scite-101') id="scite-ref-101-a" class="scite-citeref-number" title="Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022."data-reference="Qualys Hermetic Wiper March 2022"><a href="https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware" target="_blank" data-hasqtip="100" aria-describedby="qtip-100">[101]</a> </td> </tr> <tr> <td> <a href="/software/S0698"> S0698 </a> </td> <td> <a href="/software/S0698"> HermeticWizard </a> </td> <td> <a href="/software/S0698">HermeticWizard</a> can connect to remote shares using <code>WNetAddConnection2W</code>.<span onclick=scrollToRef('scite-100') id="scite-ref-100-a" class="scite-citeref-number" title="ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022."data-reference="ESET Hermetic Wizard March 2022"><a href="https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine" target="_blank" data-hasqtip="99" aria-describedby="qtip-99">[100]</a> </td> </tr> <tr> <td> <a href="/groups/G0126"> G0126 </a> </td> <td> <a href="/groups/G0126"> Higaisa </a> </td> <td> <a href="/groups/G0126">Higaisa</a> has called various native OS APIs.<span onclick=scrollToRef('scite-102') id="scite-ref-102-a" class="scite-citeref-number" title="Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021."data-reference="Zscaler Higaisa 2020"><a href="https://www.zscaler.com/blogs/security-research/return-higaisa-apt" target="_blank" data-hasqtip="101" aria-describedby="qtip-101">[102]</a> </td> </tr> <tr> <td> <a href="/software/S0431"> S0431 </a> </td> <td> <a href="/software/S0431"> HotCroissant </a> </td> <td> <a href="/software/S0431">HotCroissant</a> can perform dynamic DLL importing and API lookups using <code>LoadLibrary</code> and <code>GetProcAddress</code> on obfuscated strings.<span onclick=scrollToRef('scite-103') id="scite-ref-103-a" class="scite-citeref-number" title="US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020."data-reference="US-CERT HOTCROISSANT February 2020"><a href="https://www.us-cert.gov/ncas/analysis-reports/ar20-045d" target="_blank" data-hasqtip="102" aria-describedby="qtip-102">[103]</a> </td> </tr> <tr> <td> <a href="/software/S0398"> S0398 </a> </td> <td> <a href="/software/S0398"> HyperBro </a> </td> <td> <a href="/software/S0398">HyperBro</a> has the ability to run an application (<code>CreateProcessW</code>) or script/file (<code>ShellExecuteW</code>) via API.<span onclick=scrollToRef('scite-104') id="scite-ref-104-a" class="scite-citeref-number" title="Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019."data-reference="Unit42 Emissary Panda May 2019"><a href="https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/" target="_blank" data-hasqtip="103" aria-describedby="qtip-103">[104]</a> </td> </tr> <tr> <td> <a href="/software/S0537"> S0537 </a> </td> <td> <a href="/software/S0537"> HyperStack </a> </td> <td> <a href="/software/S0537">HyperStack</a> can use Windows API's <code>ConnectNamedPipe</code> and <code>WNetAddConnection2</code> to detect incoming connections and connect to remote shares.<span onclick=scrollToRef('scite-105') id="scite-ref-105-a" class="scite-citeref-number" title="Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020."data-reference="Accenture HyperStack October 2020"><a href="https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity" target="_blank" data-hasqtip="104" aria-describedby="qtip-104">[105]</a> </td> </tr> <tr> <td> <a href="/software/S0483"> S0483 </a> </td> <td> <a href="/software/S0483"> IcedID </a> </td> <td> <a href="/software/S0483">IcedID</a> has called <code>ZwWriteVirtualMemory</code>, <code>ZwProtectVirtualMemory</code>, <code>ZwQueueApcThread</code>, and <code>NtResumeThread</code> to inject itself into a remote process.<span onclick=scrollToRef('scite-106') id="scite-ref-106-a" class="scite-citeref-number" title="Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020."data-reference="Juniper IcedID June 2020"><a href="https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware" target="_blank" data-hasqtip="105" aria-describedby="qtip-105">[106]</a> </td> </tr> <tr> <td> <a href="/software/S1152"> S1152 </a> </td> <td> <a href="/software/S1152"> IMAPLoader </a> </td> <td> <a href="/software/S1152">IMAPLoader</a> imports native Windows APIs such as <code>GetConsoleWindow</code> and <code>ShowWindow</code>.<span onclick=scrollToRef('scite-107') id="scite-ref-107-a" class="scite-citeref-number" title="PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024."data-reference="PWC Yellow Liderc 2023"><a href="https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html" target="_blank" data-hasqtip="106" aria-describedby="qtip-106">[107]</a> </td> </tr> <tr> <td> <a href="/software/S0434"> S0434 </a> </td> <td> <a href="/software/S0434"> Imminent Monitor </a> </td> <td> <a href="/software/S0434">Imminent Monitor</a> has leveraged CreateProcessW() call to execute the debugger.<span onclick=scrollToRef('scite-108') id="scite-ref-108-a" class="scite-citeref-number" title="QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020."data-reference="QiAnXin APT-C-36 Feb2019"><a href="https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/" target="_blank" data-hasqtip="107" aria-describedby="qtip-107">[108]</a> </td> </tr> <tr> <td> <a href="/software/S1139"> S1139 </a> </td> <td> <a href="/software/S1139"> INC Ransomware </a> </td> <td> <a href="/software/S1139">INC Ransomware</a> can use the API <code>DeviceIoControl</code> to resize the allocated space for and cause the deletion of volume shadow copy snapshots.<span onclick=scrollToRef('scite-109') id="scite-ref-109-a" class="scite-citeref-number" title="Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024."data-reference="Cybereason INC Ransomware November 2023"><a href="https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf" target="_blank" data-hasqtip="108" aria-describedby="qtip-108">[109]</a> </td> </tr> <tr> <td> <a href="/software/S0259"> S0259 </a> </td> <td> <a href="/software/S0259"> InnaputRAT </a> </td> <td> <a href="/software/S0259">InnaputRAT</a> uses the API call ShellExecuteW for execution.<span onclick=scrollToRef('scite-110') id="scite-ref-110-a" class="scite-citeref-number" title="ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018."data-reference="ASERT InnaputRAT April 2018"><a href="https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/" target="_blank" data-hasqtip="109" aria-describedby="qtip-109">[110]</a> </td> </tr> <tr> <td> <a href="/software/S0260"> S0260 </a> </td> <td> <a href="/software/S0260"> InvisiMole </a> </td> <td> <a href="/software/S0260">InvisiMole</a> can use winapiexec tool for indirect execution of <code>ShellExecuteW</code> and <code>CreateProcessA</code>.<span onclick=scrollToRef('scite-111') id="scite-ref-111-a" class="scite-citeref-number" title="Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020."data-reference="ESET InvisiMole June 2020"><a href="https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf" target="_blank" data-hasqtip="110" aria-describedby="qtip-110">[111]</a> </td> </tr> <tr> <td> <a href="/software/S1020"> S1020 </a> </td> <td> <a href="/software/S1020"> Kevin </a> </td> <td> <a href="/software/S1020">Kevin</a> can use the <code>ShowWindow</code> API to avoid detection.<span onclick=scrollToRef('scite-112') id="scite-ref-112-a" class="scite-citeref-number" title="Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022."data-reference="Kaspersky Lyceum October 2021"><a href="https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf" target="_blank" data-hasqtip="111" aria-describedby="qtip-111">[112]</a> </td> </tr> <tr> <td> <a href="/software/S0607"> S0607 </a> </td> <td> <a href="/software/S0607"> KillDisk </a> </td> <td> <a href="/software/S0607">KillDisk</a> has called the Windows API to retrieve the hard disk handle and shut down the machine.<span onclick=scrollToRef('scite-113') id="scite-ref-113-a" class="scite-citeref-number" title="Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021."data-reference="Trend Micro KillDisk 1"><a href="https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html" target="_blank" data-hasqtip="112" aria-describedby="qtip-112">[113]</a> </td> </tr> <tr> <td> <a href="/software/S0669"> S0669 </a> </td> <td> <a href="/software/S0669"> KOCTOPUS </a> </td> <td> <a href="/software/S0669">KOCTOPUS</a> can use the <code>LoadResource</code> and <code>CreateProcessW</code> APIs for execution.<span onclick=scrollToRef('scite-114') id="scite-ref-114-a" class="scite-citeref-number" title="Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021."data-reference="MalwareBytes LazyScripter Feb 2021"><a href="https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf" target="_blank" data-hasqtip="113" aria-describedby="qtip-113">[114]</a> </td> </tr> <tr> <td> <a href="/software/S0356"> S0356 </a> </td> <td> <a href="/software/S0356"> KONNI </a> </td> <td> <a href="/software/S0356">KONNI</a> has hardcoded API calls within its functions to use on the victim's machine.<span onclick=scrollToRef('scite-115') id="scite-ref-115-a" class="scite-citeref-number" title="Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022."data-reference="Malwarebytes Konni Aug 2021"><a href="https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/" target="_blank" data-hasqtip="114" aria-describedby="qtip-114">[115]</a> </td> </tr> <tr> <td> <a href="/software/S1160"> S1160 </a> </td> <td> <a href="/software/S1160"> Latrodectus </a> </td> <td> <a href="/software/S1160">Latrodectus</a> has used multiple Windows API post exploitation including <code>GetAdaptersInfo</code>, <code>CreateToolhelp32Snapshot</code>, and <code>CreateProcessW</code>.<span onclick=scrollToRef('scite-116') id="scite-ref-116-a" class="scite-citeref-number" title="Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024."data-reference="Elastic Latrodectus May 2024"><a href="https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus" target="_blank" data-hasqtip="115" aria-describedby="qtip-115">[116]</a><span onclick=scrollToRef('scite-117') id="scite-ref-117-a" class="scite-citeref-number" title="Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024."data-reference="Bitsight Latrodectus June 2024"><a href="https://www.bitsight.com/blog/latrodectus-are-you-coming-back" target="_blank" data-hasqtip="116" aria-describedby="qtip-116">[117]</a> </td> </tr> <tr> <td> <a href="/groups/G0032"> G0032 </a> </td> <td> <a href="/groups/G0032"> Lazarus Group </a> </td> <td> <a href="/groups/G0032">Lazarus Group</a> has used the Windows API <code>ObtainUserAgentString</code> to obtain the User-Agent from a compromised host to connect to a C2 server.<span onclick=scrollToRef('scite-118') id="scite-ref-118-a" class="scite-citeref-number" title="Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021."data-reference="McAfee Lazarus Jul 2020"><a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27" target="_blank" data-hasqtip="117" aria-describedby="qtip-117">[118]</a> <a href="/groups/G0032">Lazarus Group</a> has also used various, often lesser known, functions to perform various types of Discovery and <a href="/techniques/T1055">Process Injection</a>.<span onclick=scrollToRef('scite-119') id="scite-ref-119-a" class="scite-citeref-number" title="Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022."data-reference="Lazarus APT January 2022"><a href="https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/" target="_blank" data-hasqtip="118" aria-describedby="qtip-118">[119]</a><span onclick=scrollToRef('scite-120') id="scite-ref-120-a" class="scite-citeref-number" title="Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022."data-reference="Qualys LolZarus"><a href="https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns" target="_blank" data-hasqtip="119" aria-describedby="qtip-119">[120]</a> </td> </tr> <tr> <td> <a href="/software/S0395"> S0395 </a> </td> <td> <a href="/software/S0395"> LightNeuron </a> </td> <td> <a href="/software/S0395">LightNeuron</a> is capable of starting a process using CreateProcess.<span onclick=scrollToRef('scite-121') id="scite-ref-121-a" class="scite-citeref-number" title="Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019."data-reference="ESET LightNeuron May 2019"><a href="https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf" target="_blank" data-hasqtip="120" aria-describedby="qtip-120">[121]</a> </td> </tr> <tr> <td> <a href="/software/S0680"> S0680 </a> </td> <td> <a href="/software/S0680"> LitePower </a> </td> <td> <a href="/software/S0680">LitePower</a> can use various API calls.<span onclick=scrollToRef('scite-122') id="scite-ref-122-a" class="scite-citeref-number" title="Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022."data-reference="Kaspersky WIRTE November 2021"><a href="https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044" target="_blank" data-hasqtip="121" aria-describedby="qtip-121">[122]</a> </td> </tr> <tr> <td> <a href="/software/S0681"> S0681 </a> </td> <td> <a href="/software/S0681"> Lizar </a> </td> <td> <a href="/software/S0681">Lizar</a> has used various Windows API functions on a victim's machine.<span onclick=scrollToRef('scite-123') id="scite-ref-123-a" class="scite-citeref-number" title="BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022."data-reference="BiZone Lizar May 2021"><a href="https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319" target="_blank" data-hasqtip="122" aria-describedby="qtip-122">[123]</a> </td> </tr> <tr> <td> <a href="/software/S0447"> S0447 </a> </td> <td> <a href="/software/S0447"> Lokibot </a> </td> <td> <a href="/software/S0447">Lokibot</a> has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.<span onclick=scrollToRef('scite-124') id="scite-ref-124-a" class="scite-citeref-number" title="Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021."data-reference="Talos Lokibot Jan 2021"><a href="https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html" target="_blank" data-hasqtip="123" aria-describedby="qtip-123">[124]</a> </td> </tr> <tr> <td> <a href="/software/S1016"> S1016 </a> </td> <td> <a href="/software/S1016"> MacMa </a> </td> <td> <a href="/software/S1016">MacMa</a> has used macOS API functions to perform tasks.<span onclick=scrollToRef('scite-125') id="scite-ref-125-a" class="scite-citeref-number" title="M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022."data-reference="ESET DazzleSpy Jan 2022"><a href="https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/" target="_blank" data-hasqtip="124" aria-describedby="qtip-124">[125]</a><span onclick=scrollToRef('scite-126') id="scite-ref-126-a" class="scite-citeref-number" title="Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022."data-reference="Objective-See MacMa Nov 2021"><a href="https://objective-see.org/blog/blog_0x69.html" target="_blank" data-hasqtip="125" aria-describedby="qtip-125">[126]</a> </td> </tr> <tr> <td> <a href="/software/S1060"> S1060 </a> </td> <td> <a href="/software/S1060"> Mafalda </a> </td> <td> <a href="/software/S1060">Mafalda</a> can use a variety of API calls.<span onclick=scrollToRef('scite-127') id="scite-ref-127-a" class="scite-citeref-number" title="Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023."data-reference="SentinelLabs Metador Sept 2022"><a href="https://assets.sentinelone.com/sentinellabs22/metador#page=1" target="_blank" data-hasqtip="126" aria-describedby="qtip-126">[127]</a> </td> </tr> <tr> <td> <a href="/software/S0652"> S0652 </a> </td> <td> <a href="/software/S0652"> MarkiRAT </a> </td> <td> <a href="/software/S0652">MarkiRAT</a> can run the ShellExecuteW API via the Windows Command Shell.<span onclick=scrollToRef('scite-128') id="scite-ref-128-a" class="scite-citeref-number" title="GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021."data-reference="Kaspersky Ferocious Kitten Jun 2021"><a href="https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/" target="_blank" data-hasqtip="127" aria-describedby="qtip-127">[128]</a> </td> </tr> <tr> <td> <a href="/software/S0449"> S0449 </a> </td> <td> <a href="/software/S0449"> Maze </a> </td> <td> <a href="/software/S0449">Maze</a> has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.<a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/" target="_blank" data-hasqtip="128" aria-describedby="qtip-128">[129]</a> </td> </tr> <tr> <td> <a href="/software/S0576"> S0576 </a> </td> <td> <a href="/software/S0576"> MegaCortex </a> </td> <td> After escalating privileges, <a href="/software/S0576">MegaCortex</a> calls <code>TerminateProcess()</code>, <code>CreateRemoteThread</code>, and other Win32 APIs.<span onclick=scrollToRef('scite-130') id="scite-ref-130-a" class="scite-citeref-number" title="Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021."data-reference="IBM MegaCortex"><a href="https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/" target="_blank" data-hasqtip="129" aria-describedby="qtip-129">[130]</a> </td> </tr> <tr> <td> <a href="/groups/G0045"> G0045 </a> </td> <td> <a href="/groups/G0045"> menuPass </a> </td> <td> <a href="/groups/G0045">menuPass</a> has used native APIs including <code>GetModuleFileName</code>, <code>lstrcat</code>, <code>CreateFile</code>, and <code>ReadFile</code>.<span onclick=scrollToRef('scite-131') id="scite-ref-131-a" class="scite-citeref-number" title="Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020."data-reference="Symantec Cicada November 2020"><a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage" target="_blank" data-hasqtip="130" aria-describedby="qtip-130">[131]</a> </td> </tr> <tr> <td> <a href="/software/S1059"> S1059 </a> </td> <td> <a href="/software/S1059"> metaMain </a> </td> <td> <a href="/software/S1059">metaMain</a> can execute an operator-provided Windows command by leveraging functions such as <code>WinExec</code>, <code>WriteFile</code>, and <code>ReadFile</code>.<span onclick=scrollToRef('scite-127') id="scite-ref-127-a" class="scite-citeref-number" title="Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023."data-reference="SentinelLabs Metador Sept 2022"><a href="https://assets.sentinelone.com/sentinellabs22/metador#page=1" target="_blank" data-hasqtip="126" aria-describedby="qtip-126">[127]</a><span onclick=scrollToRef('scite-132') id="scite-ref-132-a" class="scite-citeref-number" title="SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023."data-reference="SentinelLabs Metador Technical Appendix Sept 2022"><a href="https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm" target="_blank" data-hasqtip="131" aria-describedby="qtip-131">[132]</a> </td> </tr> <tr> <td> <a href="/software/S0455"> S0455 </a> </td> <td> <a href="/software/S0455"> Metamorfo </a> </td> <td> <a href="/software/S0455">Metamorfo</a> has used native WINAPI calls.<span onclick=scrollToRef('scite-133') id="scite-ref-133-a" class="scite-citeref-number" title="Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020."data-reference="Medium Metamorfo Apr 2020"><a href="https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767" target="_blank" data-hasqtip="132" aria-describedby="qtip-132">[133]</a><span onclick=scrollToRef('scite-134') id="scite-ref-134-a" class="scite-citeref-number" title="Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020."data-reference="Fortinet Metamorfo Feb 2020"><a href="https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions" target="_blank" data-hasqtip="133" aria-describedby="qtip-133">[134]</a> </td> </tr> <tr> <td> <a href="/software/S0688"> S0688 </a> </td> <td> <a href="/software/S0688"> Meteor </a> </td> <td> <a href="/software/S0688">Meteor</a> can use <code>WinAPI</code> to remove a victim machine from an Active Directory domain.<span onclick=scrollToRef('scite-135') id="scite-ref-135-a" class="scite-citeref-number" title="Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022."data-reference="Check Point Meteor Aug 2021"><a href="https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/" target="_blank" data-hasqtip="134" aria-describedby="qtip-134">[135]</a> </td> </tr> <tr> <td> <a href="/software/S1015"> S1015 </a> </td> <td> <a href="/software/S1015"> Milan </a> </td> <td> <a href="/software/S1015">Milan</a> can use the API <code>DnsQuery_A</code> for DNS resolution.<span onclick=scrollToRef('scite-112') id="scite-ref-112-a" class="scite-citeref-number" title="Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022."data-reference="Kaspersky Lyceum October 2021"><a href="https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf" target="_blank" data-hasqtip="111" aria-describedby="qtip-111">[112]</a> </td> </tr> <tr> <td> <a href="/software/S0084"> S0084 </a> </td> <td> <a href="/software/S0084"> Mis-Type </a> </td> <td> <a href="/software/S0084">Mis-Type</a> has used Windows API calls, including <code>NetUserAdd</code> and <code>NetUserDel</code>.<span onclick=scrollToRef('scite-136') id="scite-ref-136-a" class="scite-citeref-number" title="Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021."data-reference="Cylance Dust Storm"><a href="https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf" target="_blank" data-hasqtip="135" aria-describedby="qtip-135">[136]</a> </td> </tr> <tr> <td> <a href="/software/S0083"> S0083 </a> </td> <td> <a href="/software/S0083"> Misdat </a> </td> <td> <a href="/software/S0083">Misdat</a> has used Windows APIs, including <code>ExitWindowsEx</code> and <code>GetKeyboardType</code>.<span onclick=scrollToRef('scite-136') id="scite-ref-136-a" class="scite-citeref-number" title="Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021."data-reference="Cylance Dust Storm"><a href="https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf" target="_blank" data-hasqtip="135" aria-describedby="qtip-135">[136]</a> </td> </tr> <tr> <td> <a href="/software/S1122"> S1122 </a> </td> <td> <a href="/software/S1122"> Mispadu </a> </td> <td> <a href="/software/S1122">Mispadu</a> has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.<span onclick=scrollToRef('scite-137') id="scite-ref-137-a" class="scite-citeref-number" title="Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024."data-reference="Segurança Informática URSA Sophisticated Loader 2020"><a href="https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/" target="_blank" data-hasqtip="136" aria-describedby="qtip-136">[137]</a><span onclick=scrollToRef('scite-138') id="scite-ref-138-a" class="scite-citeref-number" title="SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024."data-reference="SCILabs Malteiro 2021"><a href="https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/" target="_blank" data-hasqtip="137" aria-describedby="qtip-137">[138]</a> </td> </tr> <tr> <td> <a href="/software/S0256"> S0256 </a> </td> <td> <a href="/software/S0256"> Mosquito </a> </td> <td> <a href="/software/S0256">Mosquito</a> leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.<span onclick=scrollToRef('scite-139') id="scite-ref-139-a" class="scite-citeref-number" title="ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018."data-reference="ESET Turla Mosquito Jan 2018"><a href="https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf" target="_blank" data-hasqtip="138" aria-describedby="qtip-138">[139]</a> </td> </tr> <tr> <td> <a href="/software/S0630"> S0630 </a> </td> <td> <a href="/software/S0630"> Nebulae </a> </td> <td> <a href="/software/S0630">Nebulae</a> has the ability to use <code>CreateProcess</code> to execute a process.<span onclick=scrollToRef('scite-140') id="scite-ref-140-a" class="scite-citeref-number" title="Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021."data-reference="Bitdefender Naikon April 2021"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf" target="_blank" data-hasqtip="139" aria-describedby="qtip-139">[140]</a> </td> </tr> <tr> <td> <a href="/software/S0457"> S0457 </a> </td> <td> <a href="/software/S0457"> Netwalker </a> </td> <td> <a href="/software/S0457">Netwalker</a> can use Windows API functions to inject the ransomware DLL.<span onclick=scrollToRef('scite-141') id="scite-ref-141-a" class="scite-citeref-number" title="Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020."data-reference="TrendMicro Netwalker May 2020"><a href="https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/" target="_blank" data-hasqtip="140" aria-describedby="qtip-140">[141]</a> </td> </tr> <tr> <td> <a href="/software/S0198"> S0198 </a> </td> <td> <a href="/software/S0198"> NETWIRE </a> </td> <td> <a href="/software/S0198">NETWIRE</a> can use Native API including <code>CreateProcess</code> <code>GetProcessById</code>, and <code>WriteProcessMemory</code>.<span onclick=scrollToRef('scite-142') id="scite-ref-142-a" class="scite-citeref-number" title="Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021."data-reference="FireEye NETWIRE March 2019"><a href="https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing" target="_blank" data-hasqtip="141" aria-describedby="qtip-141">[142]</a> </td> </tr> <tr> <td> <a href="/software/S1090"> S1090 </a> </td> <td> <a href="/software/S1090"> NightClub </a> </td> <td> <a href="/software/S1090">NightClub</a> can use multiple native APIs including <code>GetKeyState</code>, <code>GetForegroundWindow</code>, <code>GetWindowThreadProcessId</code>, and <code>GetKeyboardLayout</code>.<span onclick=scrollToRef('scite-143') id="scite-ref-143-a" class="scite-citeref-number" title="Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023."data-reference="MoustachedBouncer ESET August 2023"><a href="https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" target="_blank" data-hasqtip="142" aria-describedby="qtip-142">[143]</a> </td> </tr> <tr> <td> <a href="/software/S1100"> S1100 </a> </td> <td> <a href="/software/S1100"> Ninja </a> </td> <td> The <a href="/software/S1100">Ninja</a> loader can call Windows APIs for discovery, process injection, and payload decryption.<span onclick=scrollToRef('scite-144') id="scite-ref-144-a" class="scite-citeref-number" title="Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024."data-reference="Kaspersky ToddyCat June 2022"><a href="https://securelist.com/toddycat/106799/" target="_blank" data-hasqtip="143" aria-describedby="qtip-143">[144]</a><span onclick=scrollToRef('scite-145') id="scite-ref-145-a" class="scite-citeref-number" title="Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024."data-reference="Kaspersky ToddyCat Check Logs October 2023"><a href="https://securelist.com/toddycat-keep-calm-and-check-logs/110696/" target="_blank" data-hasqtip="144" aria-describedby="qtip-144">[145]</a> </td> </tr> <tr> <td> <a href="/software/S0385"> S0385 </a> </td> <td> <a href="/software/S0385"> njRAT </a> </td> <td> <a href="/software/S0385">njRAT</a> has used the ShellExecute() function within a script.<span onclick=scrollToRef('scite-146') id="scite-ref-146-a" class="scite-citeref-number" title="Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019."data-reference="Trend Micro njRAT 2018"><a href="https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/" target="_blank" data-hasqtip="145" aria-describedby="qtip-145">[146]</a> </td> </tr> <tr> <td> <a href="/campaigns/C0022"> C0022 </a> </td> <td> <a href="/campaigns/C0022"> Operation Dream Job </a> </td> <td> During <a href="https://attack.mitre.org/campaigns/C0022">Operation Dream Job</a>, <a href="/groups/G0032">Lazarus Group</a> used Windows API <code>ObtainUserAgentString</code> to obtain the victim's User-Agent and used the value to connect to their C2 server.<span onclick=scrollToRef('scite-118') id="scite-ref-118-a" class="scite-citeref-number" title="Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021."data-reference="McAfee Lazarus Jul 2020"><a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27" target="_blank" data-hasqtip="117" aria-describedby="qtip-117">[118]</a> </td> </tr> <tr> <td> <a href="/campaigns/C0006"> C0006 </a> </td> <td> <a href="/campaigns/C0006"> Operation Honeybee </a> </td> <td> During <a href="https://attack.mitre.org/campaigns/C0006">Operation Honeybee</a>, the threat actors deployed malware that used API calls, including <code>CreateProcessAsUser</code>.<span onclick=scrollToRef('scite-147') id="scite-ref-147-a" class="scite-citeref-number" title="Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018."data-reference="McAfee Honeybee"><a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/" target="_blank" data-hasqtip="146" aria-describedby="qtip-146">[147]</a> </td> </tr> <tr> <td> <a href="/campaigns/C0013"> C0013 </a> </td> <td> <a href="/campaigns/C0013"> Operation Sharpshooter </a> </td> <td> During <a href="https://attack.mitre.org/campaigns/C0013">Operation Sharpshooter</a>, the first stage downloader resolved various Windows libraries and APIs, including <code>LoadLibraryA()</code>, <code>GetProcAddress()</code>, and <code>CreateProcessA()</code>.<span onclick=scrollToRef('scite-148') id="scite-ref-148-a" class="scite-citeref-number" title="Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020."data-reference="McAfee Sharpshooter December 2018"><a href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" target="_blank" data-hasqtip="147" aria-describedby="qtip-147">[148]</a> </td> </tr> <tr> <td> <a href="/campaigns/C0014"> C0014 </a> </td> <td> <a href="/campaigns/C0014"> Operation Wocao </a> </td> <td> During <a href="https://attack.mitre.org/campaigns/C0014">Operation Wocao</a>, threat actors used the <code>CreateProcessA</code> and <code>ShellExecute</code> API functions to launch commands after being injected into a selected process.<span onclick=scrollToRef('scite-149') id="scite-ref-149-a" class="scite-citeref-number" title="Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020."data-reference="FoxIT Wocao December 2019"><a href="https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf" target="_blank" data-hasqtip="148" aria-describedby="qtip-148">[149]</a> </td> </tr> <tr> <td> <a href="/software/S1050"> S1050 </a> </td> <td> <a href="/software/S1050"> PcShare </a> </td> <td> <a href="/software/S1050">PcShare</a> has used a variety of Windows API functions.<span onclick=scrollToRef('scite-88') id="scite-ref-88-a" class="scite-citeref-number" title="Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022."data-reference="Bitdefender FunnyDream Campaign November 2020"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" target="_blank" data-hasqtip="87" aria-describedby="qtip-87">[88]</a> </td> </tr> <tr> <td> <a href="/software/S1145"> S1145 </a> </td> <td> <a href="/software/S1145"> Pikabot </a> </td> <td> <a href="/software/S1145">Pikabot</a> uses native Windows APIs to determine if the process is being debugged and analyzed, such as <code>CheckRemoteDebuggerPresent</code>, <code>NtQueryInformationProcess</code>, <code>ProcessDebugPort</code>, and <code>ProcessDebugFlags</code>.<span onclick=scrollToRef('scite-150') id="scite-ref-150-a" class="scite-citeref-number" title="Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024."data-reference="Zscaler Pikabot 2023"><a href="https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot" target="_blank" data-hasqtip="149" aria-describedby="qtip-149">[150]</a> Other <a href="/software/S1145">Pikabot</a> variants populate a global list of Windows API addresses from the <code>NTDLL</code> and <code>KERNEL32</code> libraries, and references these items instead of calling the API items to obfuscate execution.<span onclick=scrollToRef('scite-151') id="scite-ref-151-a" class="scite-citeref-number" title="Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024."data-reference="Elastic Pikabot 2024"><a href="https://www.elastic.co/security-labs/pikabot-i-choose-you" target="_blank" data-hasqtip="150" aria-describedby="qtip-150">[151]</a> </td> </tr> <tr> <td> <a href="/software/S0517"> S0517 </a> </td> <td> <a href="/software/S0517"> Pillowmint </a> </td> <td> <a href="/software/S0517">Pillowmint</a> has used multiple native Windows APIs to execute and conduct process injections.<span onclick=scrollToRef('scite-152') id="scite-ref-152-a" class="scite-citeref-number" title="Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020."data-reference="Trustwave Pillowmint June 2020"><a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/" target="_blank" data-hasqtip="151" aria-describedby="qtip-151">[152]</a> </td> </tr> <tr> <td> <a href="/software/S0501"> S0501 </a> </td> <td> <a href="/software/S0501"> PipeMon </a> </td> <td> <a href="/software/S0501">PipeMon</a>'s first stage has been executed by a call to <code>CreateProcess</code> with the decryption password in an argument. <a href="/software/S0501">PipeMon</a> has used a call to <code>LoadLibrary</code> to load its installer.<span onclick=scrollToRef('scite-153') id="scite-ref-153-a" class="scite-citeref-number" title="Tartare, M. et al. (2020, May 21). No "Game over" for the Winnti Group. Retrieved August 24, 2020."data-reference="ESET PipeMon May 2020"><a href="https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/" target="_blank" data-hasqtip="152" aria-describedby="qtip-152">[153]</a> </td> </tr> <tr> <td> <a href="/software/S0435"> S0435 </a> </td> <td> <a href="/software/S0435"> PLEAD </a> </td> <td> <a href="/software/S0435">PLEAD</a> can use <code>ShellExecute</code> to execute applications.<span onclick=scrollToRef('scite-154') id="scite-ref-154-a" class="scite-citeref-number" title="Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020."data-reference="TrendMicro BlackTech June 2017"><a href="https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/" target="_blank" data-hasqtip="153" aria-describedby="qtip-153">[154]</a> </td> </tr> <tr> <td> <a href="/software/S0013"> S0013 </a> </td> <td> <a href="/software/S0013"> PlugX </a> </td> <td> <a href="/software/S0013">PlugX</a> can use the Windows API functions <code>GetProcAddress</code>, <code>LoadLibrary</code>, and <code>CreateProcess</code> to execute another process.<span onclick=scrollToRef('scite-155') id="scite-ref-155-a" class="scite-citeref-number" title="Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015."data-reference="Lastline PlugX Analysis"><a href="http://labs.lastline.com/an-analysis-of-plugx" target="_blank" data-hasqtip="154" aria-describedby="qtip-154">[155]</a><span onclick=scrollToRef('scite-156') id="scite-ref-156-a" class="scite-citeref-number" title="Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022."data-reference="Proofpoint TA416 Europe March 2022"><a href="https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european" target="_blank" data-hasqtip="155" aria-describedby="qtip-155">[156]</a> </td> </tr> <tr> <td> <a href="/software/S0518"> S0518 </a> </td> <td> <a href="/software/S0518"> PolyglotDuke </a> </td> <td> <a href="/software/S0518">PolyglotDuke</a> can use <code>LoadLibraryW</code> and <code>CreateProcess</code> to load and execute code.<span onclick=scrollToRef('scite-85') id="scite-ref-85-a" class="scite-citeref-number" title="Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020."data-reference="ESET Dukes October 2019"><a href="https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" target="_blank" data-hasqtip="84" aria-describedby="qtip-84">[85]</a> </td> </tr> <tr> <td> <a href="/software/S0453"> S0453 </a> </td> <td> <a href="/software/S0453"> Pony </a> </td> <td> <a href="/software/S0453">Pony</a> has used several Windows functions for various purposes.<span onclick=scrollToRef('scite-157') id="scite-ref-157-a" class="scite-citeref-number" title="hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020."data-reference="Malwarebytes Pony April 2016"><a href="https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/" target="_blank" data-hasqtip="156" aria-describedby="qtip-156">[157]</a> </td> </tr> <tr> <td> <a href="/software/S1058"> S1058 </a> </td> <td> <a href="/software/S1058"> Prestige </a> </td> <td> <a href="/software/S1058">Prestige</a> has used the <code>Wow64DisableWow64FsRedirection()</code> and <code>Wow64RevertWow64FsRedirection()</code> functions to disable and restore file system redirection.<span onclick=scrollToRef('scite-158') id="scite-ref-158-a" class="scite-citeref-number" title="MSTIC. (2022, October 14). New "Prestige" ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023."data-reference="Microsoft Prestige ransomware October 2022"><a href="https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/" target="_blank" data-hasqtip="157" aria-describedby="qtip-157">[158]</a> </td> </tr> <tr> <td> <a href="/software/S0147"> S0147 </a> </td> <td> <a href="/software/S0147"> Pteranodon </a> </td> <td> <a href="/software/S0147">Pteranodon</a> has used various API calls.<span onclick=scrollToRef('scite-159') id="scite-ref-159-a" class="scite-citeref-number" title="Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022."data-reference="Microsoft Actinium February 2022"><a href="https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/" target="_blank" data-hasqtip="158" aria-describedby="qtip-158">[159]</a> </td> </tr> <tr> <td> <a href="/software/S0650"> S0650 </a> </td> <td> <a href="/software/S0650"> QakBot </a> </td> <td> <a href="/software/S0650">QakBot</a> can use <code>GetProcAddress</code> to help delete malicious strings from memory.<span onclick=scrollToRef('scite-160') id="scite-ref-160-a" class="scite-citeref-number" title="Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021."data-reference="ATT QakBot April 2021"><a href="https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot" target="_blank" data-hasqtip="159" aria-describedby="qtip-159">[160]</a> </td> </tr> <tr> <td> <a href="/software/S1076"> S1076 </a> </td> <td> <a href="/software/S1076"> QUIETCANARY </a> </td> <td> <a href="/software/S1076">QUIETCANARY</a> can call <code>System.Net.HttpWebRequest</code> to identify the default proxy configured on the victim computer.<span onclick=scrollToRef('scite-161') id="scite-ref-161-a" class="scite-citeref-number" title="Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023."data-reference="Mandiant Suspected Turla Campaign February 2023"><a href="https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" target="_blank" data-hasqtip="160" aria-describedby="qtip-160">[161]</a> </td> </tr> <tr> <td> <a href="/software/S0629"> S0629 </a> </td> <td> <a href="/software/S0629"> RainyDay </a> </td> <td> The file collection tool used by <a href="/software/S0629">RainyDay</a> can utilize native API including <code>ReadDirectoryChangeW</code> for folder monitoring.<span onclick=scrollToRef('scite-140') id="scite-ref-140-a" class="scite-citeref-number" title="Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021."data-reference="Bitdefender Naikon April 2021"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf" target="_blank" data-hasqtip="139" aria-describedby="qtip-139">[140]</a> </td> </tr> <tr> <td> <a href="/software/S0458"> S0458 </a> </td> <td> <a href="/software/S0458"> Ramsay </a> </td> <td> <a href="/software/S0458">Ramsay</a> can use Windows API functions such as <code>WriteFile</code>, <code>CloseHandle</code>, and <code>GetCurrentHwProfile</code> during its collection and file storage operations. <a href="/software/S0458">Ramsay</a> can execute its embedded components via <code>CreateProcessA</code> and <code>ShellExecute</code>.<span onclick=scrollToRef('scite-162') id="scite-ref-162-a" class="scite-citeref-number" title="Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020."data-reference="Eset Ramsay May 2020"><a href="https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/" target="_blank" data-hasqtip="161" aria-describedby="qtip-161">[162]</a> </td> </tr> <tr> <td> <a href="/software/S0662"> S0662 </a> </td> <td> <a href="/software/S0662"> RCSession </a> </td> <td> <a href="/software/S0662">RCSession</a> can use WinSock API for communication including <code>WSASend</code> and <code>WSARecv</code>.<span onclick=scrollToRef('scite-163') id="scite-ref-163-a" class="scite-citeref-number" title="Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021."data-reference="Profero APT27 December 2020"><a href="https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf" target="_blank" data-hasqtip="162" aria-describedby="qtip-162">[163]</a> </td> </tr> <tr> <td> <a href="/software/S0416"> S0416 </a> </td> <td> <a href="/software/S0416"> RDFSNIFFER </a> </td> <td> <a href="/software/S0416">RDFSNIFFER</a> has used several Win32 API functions to interact with the victim machine.<span onclick=scrollToRef('scite-164') id="scite-ref-164-a" class="scite-citeref-number" title="Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019."data-reference="FireEye FIN7 Oct 2019"><a href="https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html" target="_blank" data-hasqtip="163" aria-describedby="qtip-163">[164]</a> </td> </tr> <tr> <td> <a href="/software/S0496"> S0496 </a> </td> <td> <a href="/software/S0496"> REvil </a> </td> <td> <a href="/software/S0496">REvil</a> can use Native API for execution and to retrieve active services.<span onclick=scrollToRef('scite-165') id="scite-ref-165-a" class="scite-citeref-number" title="Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020."data-reference="Secureworks REvil September 2019"><a href="https://www.secureworks.com/research/revil-sodinokibi-ransomware" target="_blank" data-hasqtip="164" aria-describedby="qtip-164">[165]</a><span onclick=scrollToRef('scite-166') id="scite-ref-166-a" class="scite-citeref-number" title="Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020."data-reference="Intel 471 REvil March 2020"><a href="https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/" target="_blank" data-hasqtip="165" aria-describedby="qtip-165">[166]</a> </td> </tr> <tr> <td> <a href="/software/S0448"> S0448 </a> </td> <td> <a href="/software/S0448"> Rising Sun </a> </td> <td> <a href="/software/S0448">Rising Sun</a> used dynamic API resolutions to various Windows APIs by leveraging <code>LoadLibrary()</code> and <code>GetProcAddress()</code>.<span onclick=scrollToRef('scite-148') id="scite-ref-148-a" class="scite-citeref-number" title="Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020."data-reference="McAfee Sharpshooter December 2018"><a href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" target="_blank" data-hasqtip="147" aria-describedby="qtip-147">[148]</a> </td> </tr> <tr> <td> <a href="/software/S0240"> S0240 </a> </td> <td> <a href="/software/S0240"> ROKRAT </a> </td> <td> <a href="/software/S0240">ROKRAT</a> can use a variety of API calls to execute shellcode.<span onclick=scrollToRef('scite-167') id="scite-ref-167-a" class="scite-citeref-number" title="Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022."data-reference="Malwarebytes RokRAT VBA January 2021"><a href="https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/" target="_blank" data-hasqtip="166" aria-describedby="qtip-166">[167]</a> </td> </tr> <tr> <td> <a href="/software/S1078"> S1078 </a> </td> <td> <a href="/software/S1078"> RotaJakiro </a> </td> <td> When executing with non-root permissions, <a href="/software/S1078">RotaJakiro</a> uses the the <code>shmget</code> API to create shared memory between other known <a href="/software/S1078">RotaJakiro</a> processes. <a href="/software/S1078">RotaJakiro</a> also uses the <code>execvp</code> API to help its dead process "resurrect".<span onclick=scrollToRef('scite-168') id="scite-ref-168-a" class="scite-citeref-number" title=" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023."data-reference="RotaJakiro 2021 netlab360 analysis"><a href="https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/" target="_blank" data-hasqtip="167" aria-describedby="qtip-167">[168]</a> </td> </tr> <tr> <td> <a href="/software/S1073"> S1073 </a> </td> <td> <a href="/software/S1073"> Royal </a> </td> <td> <a href="/software/S1073">Royal</a> can use multiple APIs for discovery, communication, and execution.<span onclick=scrollToRef('scite-169') id="scite-ref-169-a" class="scite-citeref-number" title="Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023."data-reference="Cybereason Royal December 2022"><a href="https://www.cybereason.com/blog/royal-ransomware-analysis" target="_blank" data-hasqtip="168" aria-describedby="qtip-168">[169]</a> </td> </tr> <tr> <td> <a href="/software/S0148"> S0148 </a> </td> <td> <a href="/software/S0148"> RTM </a> </td> <td> <a href="/software/S0148">RTM</a> can use the <code>FindNextUrlCacheEntryA</code> and <code>FindFirstUrlCacheEntryA</code> functions to search for specific strings within browser history.<span onclick=scrollToRef('scite-170') id="scite-ref-170-a" class="scite-citeref-number" title="Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017."data-reference="ESET RTM Feb 2017"><a href="https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf" target="_blank" data-hasqtip="169" aria-describedby="qtip-169">[170]</a> </td> </tr> <tr> <td> <a href="/software/S0446"> S0446 </a> </td> <td> <a href="/software/S0446"> Ryuk </a> </td> <td> <a href="/software/S0446">Ryuk</a> has used multiple native APIs including <code>ShellExecuteW</code> to run executables,<code>GetWindowsDirectoryW</code> to create folders, and <code>VirtualAlloc</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code> for process injection.<span onclick=scrollToRef('scite-171') id="scite-ref-171-a" class="scite-citeref-number" title="Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020."data-reference="CrowdStrike Ryuk January 2019"><a href="https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/" target="_blank" data-hasqtip="170" aria-describedby="qtip-170">[171]</a> </td> </tr> <tr> <td> <a href="/software/S0085"> S0085 </a> </td> <td> <a href="/software/S0085"> S-Type </a> </td> <td> <a href="/software/S0085">S-Type</a> has used Windows APIs, including <code>GetKeyboardType</code>, <code>NetUserAdd</code>, and <code>NetUserDel</code>.<span onclick=scrollToRef('scite-136') id="scite-ref-136-a" class="scite-citeref-number" title="Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021."data-reference="Cylance Dust Storm"><a href="https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf" target="_blank" data-hasqtip="135" aria-describedby="qtip-135">[136]</a> </td> </tr> <tr> <td> <a href="/software/S1018"> S1018 </a> </td> <td> <a href="/software/S1018"> Saint Bot </a> </td> <td> <a href="/software/S1018">Saint Bot</a> has used different API calls, including <code>GetProcAddress</code>, <code>VirtualAllocEx</code>, <code>WriteProcessMemory</code>, <code>CreateProcessA</code>, and <code>SetThreadContext</code>.<span onclick=scrollToRef('scite-172') id="scite-ref-172-a" class="scite-citeref-number" title="Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022."data-reference="Malwarebytes Saint Bot April 2021"><a href="https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/" target="_blank" data-hasqtip="171" aria-describedby="qtip-171">[172]</a><span onclick=scrollToRef('scite-173') id="scite-ref-173-a" class="scite-citeref-number" title="Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022."data-reference="Palo Alto Unit 42 OutSteel SaintBot February 2022 "><a href="https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/" target="_blank" data-hasqtip="172" aria-describedby="qtip-172">[173]</a> </td> </tr> <tr> <td> <a href="/software/S1099"> S1099 </a> </td> <td> <a href="/software/S1099"> Samurai </a> </td> <td> <a href="/software/S1099">Samurai</a> has the ability to call Windows APIs.<span onclick=scrollToRef('scite-144') id="scite-ref-144-a" class="scite-citeref-number" title="Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024."data-reference="Kaspersky ToddyCat June 2022"><a href="https://securelist.com/toddycat/106799/" target="_blank" data-hasqtip="143" aria-describedby="qtip-143">[144]</a> </td> </tr> <tr> <td> <a href="/groups/G0034"> G0034 </a> </td> <td> <a href="/groups/G0034"> Sandworm Team </a> </td> <td> <a href="/groups/G0034">Sandworm Team</a> uses <a href="/software/S1058">Prestige</a> to disable and restore file system redirection by using the following functions: <code>Wow64DisableWow64FsRedirection()</code> and <code>Wow64RevertWow64FsRedirection()</code>.<span onclick=scrollToRef('scite-158') id="scite-ref-158-a" class="scite-citeref-number" title="MSTIC. (2022, October 14). New "Prestige" ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023."data-reference="Microsoft Prestige ransomware October 2022"><a href="https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/" target="_blank" data-hasqtip="157" aria-describedby="qtip-157">[158]</a> </td> </tr> <tr> <td> <a href="/software/S1085"> S1085 </a> </td> <td> <a href="/software/S1085"> Sardonic </a> </td> <td> <a href="/software/S1085">Sardonic</a> has the ability to call Win32 API functions to determine if <code>powershell.exe</code> is running.<span onclick=scrollToRef('scite-174') id="scite-ref-174-a" class="scite-citeref-number" title="Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023."data-reference="Bitdefender Sardonic Aug 2021"><a href="https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf" target="_blank" data-hasqtip="173" aria-describedby="qtip-173">[174]</a> </td> </tr> <tr> <td> <a href="/software/S1089"> S1089 </a> </td> <td> <a href="/software/S1089"> SharpDisco </a> </td> <td> <a href="/software/S1089">SharpDisco</a> can leverage Native APIs through plugins including <code>GetLogicalDrives</code>.<span onclick=scrollToRef('scite-143') id="scite-ref-143-a" class="scite-citeref-number" title="Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023."data-reference="MoustachedBouncer ESET August 2023"><a href="https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" target="_blank" data-hasqtip="142" aria-describedby="qtip-142">[143]</a> </td> </tr> <tr> <td> <a href="/software/S0444"> S0444 </a> </td> <td> <a href="/software/S0444"> ShimRat </a> </td> <td> <a href="/software/S0444">ShimRat</a> has used Windows API functions to install the service and shim.<span onclick=scrollToRef('scite-175') id="scite-ref-175-a" class="scite-citeref-number" title="Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020."data-reference="FOX-IT May 2016 Mofang"><a href="https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" target="_blank" data-hasqtip="174" aria-describedby="qtip-174">[175]</a> </td> </tr> <tr> <td> <a href="/software/S0445"> S0445 </a> </td> <td> <a href="/software/S0445"> ShimRatReporter </a> </td> <td> <a href="/software/S0445">ShimRatReporter</a> used several Windows API functions to gather information from the infected system.<span onclick=scrollToRef('scite-175') id="scite-ref-175-a" class="scite-citeref-number" title="Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020."data-reference="FOX-IT May 2016 Mofang"><a href="https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" target="_blank" data-hasqtip="174" aria-describedby="qtip-174">[175]</a> </td> </tr> <tr> <td> <a href="/groups/G1008"> G1008 </a> </td> <td> <a href="/groups/G1008"> SideCopy </a> </td> <td> <a href="/groups/G1008">SideCopy</a> has executed malware by calling the API function <code>CreateProcessW</code>.<span onclick=scrollToRef('scite-176') id="scite-ref-176-a" class="scite-citeref-number" title="Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022."data-reference="MalwareBytes SideCopy Dec 2021"><a href="https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure" target="_blank" data-hasqtip="175" aria-describedby="qtip-175">[176]</a> </td> </tr> <tr> <td> <a href="/software/S0610"> S0610 </a> </td> <td> <a href="/software/S0610"> SideTwist </a> </td> <td> <a href="/software/S0610">SideTwist</a> can use <code>GetUserNameW</code>, <code>GetComputerNameW</code>, and <code>GetComputerNameExW</code> to gather information.<span onclick=scrollToRef('scite-177') id="scite-ref-177-a" class="scite-citeref-number" title="Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021."data-reference="Check Point APT34 April 2021"><a href="https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/" target="_blank" data-hasqtip="176" aria-describedby="qtip-176">[177]</a> </td> </tr> <tr> <td> <a href="/groups/G0091"> G0091 </a> </td> <td> <a href="/groups/G0091"> Silence </a> </td> <td> <a href="/groups/G0091">Silence</a> has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.<span onclick=scrollToRef('scite-178') id="scite-ref-178-a" class="scite-citeref-number" title="GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019."data-reference="SecureList Silence Nov 2017"><a href="https://securelist.com/the-silence/83009/" target="_blank" data-hasqtip="177" aria-describedby="qtip-177">[178]</a><span onclick=scrollToRef('scite-179') id="scite-ref-179-a" class="scite-citeref-number" title="Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020."data-reference="Group IB Silence Sept 2018"><a href="https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA." target="_blank" data-hasqtip="178" aria-describedby="qtip-178">[179]</a> </td> </tr> <tr> <td> <a href="/software/S0692"> S0692 </a> </td> <td> <a href="/software/S0692"> SILENTTRINITY </a> </td> <td> <a href="/software/S0692">SILENTTRINITY</a> has the ability to leverage API including <code>GetProcAddress</code> and <code>LoadLibrary</code>.<span onclick=scrollToRef('scite-180') id="scite-ref-180-a" class="scite-citeref-number" title="Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022."data-reference="GitHub SILENTTRINITY Modules July 2019"><a href="https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo" target="_blank" data-hasqtip="179" aria-describedby="qtip-179">[180]</a> </td> </tr> <tr> <td> <a href="/software/S0623"> S0623 </a> </td> <td> <a href="/software/S0623"> Siloscape </a> </td> <td> <a href="/software/S0623">Siloscape</a> makes various native API calls.<span onclick=scrollToRef('scite-181') id="scite-ref-181-a" class="scite-citeref-number" title="Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021."data-reference="Unit 42 Siloscape Jun 2021"><a href="https://unit42.paloaltonetworks.com/siloscape/" target="_blank" data-hasqtip="180" aria-describedby="qtip-180">[181]</a> </td> </tr> <tr> <td> <a href="/software/S0627"> S0627 </a> </td> <td> <a href="/software/S0627"> SodaMaster </a> </td> <td> <a href="/software/S0627">SodaMaster</a> can use <code>RegOpenKeyW</code> to access the Registry.<span onclick=scrollToRef('scite-182') id="scite-ref-182-a" class="scite-citeref-number" title="GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021."data-reference="Securelist APT10 March 2021"><a href="https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/" target="_blank" data-hasqtip="181" aria-describedby="qtip-181">[182]</a> </td> </tr> <tr> <td> <a href="/software/S0615"> S0615 </a> </td> <td> <a href="/software/S0615"> SombRAT </a> </td> <td> <a href="/software/S0615">SombRAT</a> has the ability to respawn itself using <code>ShellExecuteW</code> and <code>CreateProcessW</code>.<span onclick=scrollToRef('scite-67') id="scite-ref-67-a" class="scite-citeref-number" title="The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021."data-reference="BlackBerry CostaRicto November 2020"><a href="https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced" target="_blank" data-hasqtip="66" aria-describedby="qtip-66">[67]</a> </td> </tr> <tr> <td> <a href="/software/S1034"> S1034 </a> </td> <td> <a href="/software/S1034"> StrifeWater </a> </td> <td> <a href="/software/S1034">StrifeWater</a> can use a variety of APIs for execution.<span onclick=scrollToRef('scite-183') id="scite-ref-183-a" class="scite-citeref-number" title="Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022."data-reference="Cybereason StrifeWater Feb 2022"><a href="https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations" target="_blank" data-hasqtip="182" aria-describedby="qtip-182">[183]</a> </td> </tr> <tr> <td> <a href="/software/S0603"> S0603 </a> </td> <td> <a href="/software/S0603"> Stuxnet </a> </td> <td> <a href="/software/S0603">Stuxnet</a> uses the SetSecurityDescriptorDacl API to reduce object integrity levels.<span onclick=scrollToRef('scite-184') id="scite-ref-184-a" class="scite-citeref-number" title="Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 "data-reference="Nicolas Falliere, Liam O Murchu, Eric Chien February 2011"><a href="https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf" target="_blank" data-hasqtip="183" aria-describedby="qtip-183">[184]</a> </td> </tr> <tr> <td> <a href="/software/S0562"> S0562 </a> </td> <td> <a href="/software/S0562"> SUNSPOT </a> </td> <td> <a href="/software/S0562">SUNSPOT</a> used Windows API functions such as <code>MoveFileEx</code> and <code>NtQueryInformationProcess</code> as part of the <a href="/software/S0559">SUNBURST</a> injection process.<span onclick=scrollToRef('scite-185') id="scite-ref-185-a" class="scite-citeref-number" title="CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021."data-reference="CrowdStrike SUNSPOT Implant January 2021"><a href="https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/" target="_blank" data-hasqtip="184" aria-describedby="qtip-184">[185]</a> </td> </tr> <tr> <td> <a href="/software/S1064"> S1064 </a> </td> <td> <a href="/software/S1064"> SVCReady </a> </td> <td> <a href="/software/S1064">SVCReady</a> can use Windows API calls to gather information from an infected host.<span onclick=scrollToRef('scite-186') id="scite-ref-186-a" class="scite-citeref-number" title="Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022."data-reference="HP SVCReady Jun 2022"><a href="https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/" target="_blank" data-hasqtip="185" aria-describedby="qtip-185">[186]</a> </td> </tr> <tr> <td> <a href="/software/S0242"> S0242 </a> </td> <td> <a href="/software/S0242"> SynAck </a> </td> <td> <a href="/software/S0242">SynAck</a> parses the export tables of system DLLs to locate and call various Windows API functions.<span onclick=scrollToRef('scite-187') id="scite-ref-187-a" class="scite-citeref-number" title="Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018."data-reference="SecureList SynAck Doppelgänging May 2018"><a href="https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/" target="_blank" data-hasqtip="186" aria-describedby="qtip-186">[187]</a><span onclick=scrollToRef('scite-188') id="scite-ref-188-a" class="scite-citeref-number" title="Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018."data-reference="Kaspersky Lab SynAck May 2018"><a href="https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging" target="_blank" data-hasqtip="187" aria-describedby="qtip-187">[188]</a> </td> </tr> <tr> <td> <a href="/software/S0663"> S0663 </a> </td> <td> <a href="/software/S0663"> SysUpdate </a> </td> <td> <a href="/software/S0663">SysUpdate</a> can call the <code>GetNetworkParams</code> API as part of its C2 establishment process.<span onclick=scrollToRef('scite-189') id="scite-ref-189-a" class="scite-citeref-number" title="Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023."data-reference="Lunghi Iron Tiger Linux"><a href="https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html" target="_blank" data-hasqtip="188" aria-describedby="qtip-188">[189]</a> </td> </tr> <tr> <td> <a href="/groups/G0092"> G0092 </a> </td> <td> <a href="/groups/G0092"> TA505 </a> </td> <td> <a href="/groups/G0092">TA505</a> has deployed payloads that use Windows API calls on a compromised host.<span onclick=scrollToRef('scite-190') id="scite-ref-190-a" class="scite-citeref-number" title="Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022."data-reference="Korean FSI TA505 2020"><a href="https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=" target="_blank" data-hasqtip="189" aria-describedby="qtip-189">[190]</a> </td> </tr> <tr> <td> <a href="/software/S0011"> S0011 </a> </td> <td> <a href="/software/S0011"> Taidoor </a> </td> <td> <a href="/software/S0011">Taidoor</a> has the ability to use native APIs for execution including <code>GetProcessHeap</code>, <code>GetProcAddress</code>, and <code>LoadLibrary</code>.<a href="http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf" target="_blank" data-hasqtip="190" aria-describedby="qtip-190">[191]</a><span onclick=scrollToRef('scite-192') id="scite-ref-192-a" class="scite-citeref-number" title="CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021."data-reference="CISA MAR-10292089-1.v2 TAIDOOR August 2021"><a href="https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a" target="_blank" data-hasqtip="191" aria-describedby="qtip-191">[192]</a> </td> </tr> <tr> <td> <a href="/software/S0595"> S0595 </a> </td> <td> <a href="/software/S0595"> ThiefQuest </a> </td> <td> <a href="/software/S0595">ThiefQuest</a> uses various API to perform behaviors such as executing payloads and performing local enumeration.<span onclick=scrollToRef('scite-193') id="scite-ref-193-a" class="scite-citeref-number" title="Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021."data-reference="wardle evilquest partii"><a href="https://objective-see.com/blog/blog_0x60.html" target="_blank" data-hasqtip="192" aria-describedby="qtip-192">[193]</a> </td> </tr> <tr> <td> <a href="/software/S0668"> S0668 </a> </td> <td> <a href="/software/S0668"> TinyTurla </a> </td> <td> <a href="/software/S0668">TinyTurla</a> has used <code>WinHTTP</code>, <code>CreateProcess</code>, and other APIs for C2 communications and other functions.<span onclick=scrollToRef('scite-194') id="scite-ref-194-a" class="scite-citeref-number" title="Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021."data-reference="Talos TinyTurla September 2021"><a href="https://blog.talosintelligence.com/2021/09/tinyturla.html" target="_blank" data-hasqtip="193" aria-describedby="qtip-193">[194]</a> </td> </tr> <tr> <td> <a href="/groups/G1022"> G1022 </a> </td> <td> <a href="/groups/G1022"> ToddyCat </a> </td> <td> <a href="/groups/G1022">ToddyCat</a> has used <code>WinExec</code> to execute commands received from C2 on compromised hosts.<span onclick=scrollToRef('scite-145') id="scite-ref-145-a" class="scite-citeref-number" title="Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024."data-reference="Kaspersky ToddyCat Check Logs October 2023"><a href="https://securelist.com/toddycat-keep-calm-and-check-logs/110696/" target="_blank" data-hasqtip="144" aria-describedby="qtip-144">[145]</a> </td> </tr> <tr> <td> <a href="/software/S0678"> S0678 </a> </td> <td> <a href="/software/S0678"> Torisma </a> </td> <td> <a href="/software/S0678">Torisma</a> has used various Windows API calls.<span onclick=scrollToRef('scite-195') id="scite-ref-195-a" class="scite-citeref-number" title="Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021."data-reference="McAfee Lazarus Nov 2020"><a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/" target="_blank" data-hasqtip="194" aria-describedby="qtip-194">[195]</a> </td> </tr> <tr> <td> <a href="/software/S0266"> S0266 </a> </td> <td> <a href="/software/S0266"> TrickBot </a> </td> <td> <a href="/software/S0266">TrickBot</a> uses the Windows API call, CreateProcessW(), to manage execution flow.<span onclick=scrollToRef('scite-196') id="scite-ref-196-a" class="scite-citeref-number" title="Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018."data-reference="S2 Grupo TrickBot June 2017"><a href="https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf" target="_blank" data-hasqtip="195" aria-describedby="qtip-195">[196]</a> <a href="/software/S0266">TrickBot</a> has also used <code>Nt*</code> API functions to perform <a href="/techniques/T1055">Process Injection</a>.<span onclick=scrollToRef('scite-197') id="scite-ref-197-a" class="scite-citeref-number" title="Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021."data-reference="Joe Sec Trickbot"><a href="https://www.joesecurity.org/blog/498839998833561473" target="_blank" data-hasqtip="196" aria-describedby="qtip-196">[197]</a> </td> </tr> <tr> <td> <a href="/groups/G0081"> G0081 </a> </td> <td> <a href="/groups/G0081"> Tropic Trooper </a> </td> <td> <a href="/groups/G0081">Tropic Trooper</a> has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.<span onclick=scrollToRef('scite-198') id="scite-ref-198-a" class="scite-citeref-number" title="Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020."data-reference="TrendMicro Tropic Trooper May 2020"><a href="https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf" target="_blank" data-hasqtip="197" aria-describedby="qtip-197">[198]</a> </td> </tr> <tr> <td> <a href="/groups/G0010"> G0010 </a> </td> <td> <a href="/groups/G0010"> Turla </a> </td> <td> <a href="/groups/G0010">Turla</a> and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.<span onclick=scrollToRef('scite-199') id="scite-ref-199-a" class="scite-citeref-number" title="Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019."data-reference="ESET Turla PowerShell May 2019"><a href="https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/" target="_blank" data-hasqtip="198" aria-describedby="qtip-198">[199]</a> </td> </tr> <tr> <td> <a href="/software/S0022"> S0022 </a> </td> <td> <a href="/software/S0022"> Uroburos </a> </td> <td> <a href="/software/S0022">Uroburos</a> can use native Windows APIs including <code>GetHostByName</code>.<span onclick=scrollToRef('scite-200') id="scite-ref-200-a" class="scite-citeref-number" title="FBI et al. (2023, May 9). Hunting Russian Intelligence "Snake" Malware. Retrieved June 8, 2023."data-reference="Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023"><a href="https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf" target="_blank" data-hasqtip="199" aria-describedby="qtip-199">[200]</a> </td> </tr> <tr> <td> <a href="/software/S0386"> S0386 </a> </td> <td> <a href="/software/S0386"> Ursnif </a> </td> <td> <a href="/software/S0386">Ursnif</a> has used <code>CreateProcessW</code> to create child processes.<span onclick=scrollToRef('scite-201') id="scite-ref-201-a" class="scite-citeref-number" title="Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019."data-reference="FireEye Ursnif Nov 2017"><a href="https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html" target="_blank" data-hasqtip="200" aria-describedby="qtip-200">[201]</a> </td> </tr> <tr> <td> <a href="/software/S0180"> S0180 </a> </td> <td> <a href="/software/S0180"> Volgmer </a> </td> <td> <a href="/software/S0180">Volgmer</a> executes payloads using the Windows API call CreateProcessW().<span onclick=scrollToRef('scite-202') id="scite-ref-202-a" class="scite-citeref-number" title="US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018."data-reference="US-CERT Volgmer 2 Nov 2017"><a href="https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF" target="_blank" data-hasqtip="201" aria-describedby="qtip-201">[202]</a> </td> </tr> <tr> <td> <a href="/software/S0670"> S0670 </a> </td> <td> <a href="/software/S0670"> WarzoneRAT </a> </td> <td> <a href="/software/S0670">WarzoneRAT</a> can use a variety of API calls on a compromised host.<span onclick=scrollToRef('scite-203') id="scite-ref-203-a" class="scite-citeref-number" title="Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022."data-reference="Uptycs Warzone UAC Bypass November 2020"><a href="https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique" target="_blank" data-hasqtip="202" aria-describedby="qtip-202">[203]</a> </td> </tr> <tr> <td> <a href="/software/S0612"> S0612 </a> </td> <td> <a href="/software/S0612"> WastedLocker </a> </td> <td> <a href="/software/S0612">WastedLocker</a>'s custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.<span onclick=scrollToRef('scite-204') id="scite-ref-204-a" class="scite-citeref-number" title="Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021."data-reference="NCC Group WastedLocker June 2020"><a href="https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" target="_blank" data-hasqtip="203" aria-describedby="qtip-203">[204]</a> </td> </tr> <tr> <td> <a href="/software/S0579"> S0579 </a> </td> <td> <a href="/software/S0579"> Waterbear </a> </td> <td> <a href="/software/S0579">Waterbear</a> can leverage API functions for execution.<span onclick=scrollToRef('scite-205') id="scite-ref-205-a" class="scite-citeref-number" title="Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021."data-reference="Trend Micro Waterbear December 2019"><a href="https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html" target="_blank" data-hasqtip="204" aria-describedby="qtip-204">[205]</a> </td> </tr> <tr> <td> <a href="/software/S0689"> S0689 </a> </td> <td> <a href="/software/S0689"> WhisperGate </a> </td> <td> <a href="/software/S0689">WhisperGate</a> has used the <code>ExitWindowsEx</code> to flush file buffers to disk and stop running processes and other API calls.<span onclick=scrollToRef('scite-206') id="scite-ref-206-a" class="scite-citeref-number" title="Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022."data-reference="Cisco Ukraine Wipers January 2022"><a href="https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html" target="_blank" data-hasqtip="205" aria-describedby="qtip-205">[206]</a><span onclick=scrollToRef('scite-207') id="scite-ref-207-a" class="scite-citeref-number" title="Insikt Group. (2020, January 28). WhisperGate Malware Corrupts Computers in Ukraine. Retrieved September 16, 2024."data-reference="RecordedFuture WhisperGate Jan 2022"><a href="https://www.recordedfuture.com/research/whispergate-malware-corrupts-computers-ukraine" target="_blank" data-hasqtip="206" aria-describedby="qtip-206">[207]</a> </td> </tr> <tr> <td> <a href="/software/S0466"> S0466 </a> </td> <td> <a href="/software/S0466"> WindTail </a> </td> <td> <a href="/software/S0466">WindTail</a> can invoke Apple APIs <code>contentsOfDirectoryAtPath</code>, <code>pathExtension</code>, and (string) <code>compare</code>.<span onclick=scrollToRef('scite-208') id="scite-ref-208-a" class="scite-citeref-number" title="Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019."data-reference="objective-see windtail2 jan 2019"><a href="https://objective-see.com/blog/blog_0x3D.html" target="_blank" data-hasqtip="207" aria-describedby="qtip-207">[208]</a> </td> </tr> <tr> <td> <a href="/software/S0141"> S0141 </a> </td> <td> <a href="/software/S0141"> Winnti for Windows </a> </td> <td> <a href="/software/S0141">Winnti for Windows</a> can use Native API to create a new process and to start services.<span onclick=scrollToRef('scite-209') id="scite-ref-209-a" class="scite-citeref-number" title="Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017."data-reference="Novetta Winnti April 2015"><a href="https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf" target="_blank" data-hasqtip="208" aria-describedby="qtip-208">[209]</a> </td> </tr> <tr> <td> <a href="/software/S1065"> S1065 </a> </td> <td> <a href="/software/S1065"> Woody RAT </a> </td> <td> <a href="/software/S1065">Woody RAT</a> can use multiple native APIs, including <code>WriteProcessMemory</code>, <code>CreateProcess</code>, and <code>CreateRemoteThread</code> for process injection.<span onclick=scrollToRef('scite-210') id="scite-ref-210-a" class="scite-citeref-number" title="MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022."data-reference="MalwareBytes WoodyRAT Aug 2022"><a href="https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild" target="_blank" data-hasqtip="209" aria-describedby="qtip-209">[210]</a> </td> </tr> <tr> <td> <a href="/software/S0161"> S0161 </a> </td> <td> <a href="/software/S0161"> XAgentOSX </a> </td> <td> <a href="/software/S0161">XAgentOSX</a> contains the execFile function to execute a specified file on the system using the NSTask:launch method.<span onclick=scrollToRef('scite-211') id="scite-ref-211-a" class="scite-citeref-number" title="Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017."data-reference="XAgentOSX 2017"><a href="https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/" target="_blank" data-hasqtip="210" aria-describedby="qtip-210">[211]</a> </td> </tr> <tr> <td> <a href="/software/S0653"> S0653 </a> </td> <td> <a href="/software/S0653"> xCaon </a> </td> <td> <a href="/software/S0653">xCaon</a> has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.<span onclick=scrollToRef('scite-48') id="scite-ref-48-a" class="scite-citeref-number" title="CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021."data-reference="Checkpoint IndigoZebra July 2021"><a href="https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/" target="_blank" data-hasqtip="47" aria-describedby="qtip-47">[48]</a> </td> </tr> <tr> <td> <a href="/software/S1151"> S1151 </a> </td> <td> <a href="/software/S1151"> ZeroCleare </a> </td> <td> <a href="/software/S1151">ZeroCleare</a> can call the <code>GetSystemDirectoryW</code> API to locate the system directory.<span onclick=scrollToRef('scite-57') id="scite-ref-57-a" class="scite-citeref-number" title="Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024."data-reference="Mandiant ROADSWEEP August 2022"><a href="https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/" target="_blank" data-hasqtip="56" aria-describedby="qtip-56">[57]</a> </td> </tr> <tr> <td> <a href="/software/S0412"> S0412 </a> </td> <td> <a href="/software/S0412"> ZxShell </a> </td> <td> <a href="/software/S0412">ZxShell</a> can leverage native API including <code>RegisterServiceCtrlHandler </code> to register a service.RegisterServiceCtrlHandler </td> </tr> <tr> <td> <a href="/software/S1013"> S1013 </a> </td> <td> <a href="/software/S1013"> ZxxZ </a> </td> <td> <a href="/software/S1013">ZxxZ</a> has used API functions such as <code>Process32First</code>, <code>Process32Next</code>, and <code>ShellExecuteA</code>.<span onclick=scrollToRef('scite-212') id="scite-ref-212-a" class="scite-citeref-number" title="Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022."data-reference="Cisco Talos Bitter Bangladesh May 2022"><a href="https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html" target="_blank" data-hasqtip="211" aria-describedby="qtip-211">[212]</a> </td> </tr> </tbody> </table> </div> <h2 class="pt-3" id ="mitigations">Mitigations</h2> <div class="tables-mobile"> <table class="table table-bordered table-alternate mt-2"> <thead> <tr> <th scope="col">ID</th> <th scope="col">Mitigation</th> <th scope="col">Description</th> </tr> </thead> <tbody> <tr> <td> <a href="/mitigations/M1040"> M1040 </a> </td> <td> <a href="/mitigations/M1040"> Behavior Prevention on Endpoint </a> </td> <td> On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs. <span onclick=scrollToRef('scite-213') id="scite-ref-213-a" class="scite-citeref-number" title="Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021."data-reference="win10_asr"><a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction" target="_blank" data-hasqtip="212" aria-describedby="qtip-212">[213]</a> </td> </tr> <tr> <td> <a href="/mitigations/M1038"> M1038 </a> </td> <td> <a href="/mitigations/M1038"> Execution Prevention </a> </td> <td> Identify and block potentially malicious software executed that may be executed through this technique by using application control <span onclick=scrollToRef('scite-214') id="scite-ref-214-a" class="scite-citeref-number" title="Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014."data-reference="Beechey 2010"><a href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599" target="_blank" data-hasqtip="213" aria-describedby="qtip-213">[214]</a> tools, like Windows Defender Application Control<span onclick=scrollToRef('scite-215') id="scite-ref-215-a" class="scite-citeref-number" title="Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019."data-reference="Microsoft Windows Defender Application Control"><a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control" target="_blank" data-hasqtip="214" aria-describedby="qtip-214">[215]</a>, AppLocker, <span onclick=scrollToRef('scite-216') id="scite-ref-216-a" class="scite-citeref-number" title="Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016."data-reference="Windows Commands JPCERT"><a href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html" target="_blank" data-hasqtip="215" aria-describedby="qtip-215">[216]</a> <span onclick=scrollToRef('scite-217') id="scite-ref-217-a" class="scite-citeref-number" title="NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016."data-reference="NSA MS AppLocker"><a href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" target="_blank" data-hasqtip="216" aria-describedby="qtip-216">[217]</a> or Software Restriction Policies <span onclick=scrollToRef('scite-218') id="scite-ref-218-a" class="scite-citeref-number" title="Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024."data-reference="Corio 2008"><a href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)" target="_blank" data-hasqtip="217" aria-describedby="qtip-217">[218]</a> where appropriate. <span onclick=scrollToRef('scite-219') id="scite-ref-219-a" class="scite-citeref-number" title="Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016."data-reference="TechNet Applocker vs SRP"><a href="https://technet.microsoft.com/en-us/library/ee791851.aspx" target="_blank" data-hasqtip="218" aria-describedby="qtip-218">[219]</a> </td> </tr> </tbody> </table> </div> <h2 class="pt-3" id="detection">Detection</h2> <div class="tables-mobile"> <table class="table datasources-table table-bordered"> <thead> <tr> <th class="p-2" scope="col">ID</th> <th class="p-2 nowrap" scope="col">Data Source</th> <th class="p-2 nowrap" scope="col">Data Component</th> <th class="p-2" scope="col">Detects</th> </tr> </thead> <tbody> <tr class="datasource" id="uses-DS0011"> <td> <a href="/datasources/DS0011">DS0011</a> </td> <td class="nowrap"> <a href="/datasources/DS0011">Module</a> </td>  <td> <a href="/datasources/DS0011/#Module%20Load">Module Load</a> </td> <td> Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Utilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity.Analytic 1 - Look for unusual or abnormal DLL loads, processes loading DLLs not typically associated with them<code>sourcetype=Sysmon EventCode=7| stats count by module_name process_name user| where module_name IN ("ntdll.dll", "kernel32.dll", "advapi32.dll", "user32.dll", "gdi32.dll") </code> </td> </tr> <tr class="datasource" id="uses-DS0009"> <td> <a href="/datasources/DS0009">DS0009</a> </td> <td class="nowrap"> <a href="/datasources/DS0009">Process</a> </td>  <td> <a href="/datasources/DS0009/#OS%20API%20Execution">OS API Execution</a> </td> <td> Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior. Correlation of activity by process lineage by process ID may be sufficient. </td> </tr> </tbody> </table> </div> <h2 class="pt-3" id="references">References</h2> <div class="row"> <div class="col"> <ol> <li> <a rel="nofollow" class="external text" name="scite-1" href="https://undocumented.ntinternals.net/" target="_blank"> The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-2" href="https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html" target="_blank"> Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-3" href="https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/" target="_blank"> de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-4" href="https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/" target="_blank"> Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-5" href="https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/" target="_blank"> MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-6" href="https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa" target="_blank"> Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-7" href="https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html" target="_blank"> Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-8" href="https://docs.microsoft.com/en-us/windows/win32/api/" target="_blank"> Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-9" href="https://man7.org/linux/man-pages//man7/libc.7.html" target="_blank"> Kerrisk, M. (2016, December 12). libc(7) — Linux manual page. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-10" href="https://www.gnu.org/software/libc/" target="_blank"> glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-11" href="https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework" target="_blank"> Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-12" href="https://developer.apple.com/documentation/coreservices" target="_blank"> Apple. (n.d.). Core Services. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-13" href="https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1" target="_blank"> Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-14" href="https://developer.apple.com/documentation/foundation" target="_blank"> Apple. (n.d.). Foundation. Retrieved July 1, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-15" href="https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls" target="_blank"> Feichter, D. (2023, June 30). Direct Syscalls vs Indirect Syscalls. Retrieved September 27, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-16" href="https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf" target="_blank"> Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-17" href="https://www.trellix.com/blogs/research/akira-ransomware/" target="_blank"> Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-18" href="https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot" target="_blank"> Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-19" href="https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/" target="_blank"> Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-20" href="https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html" target="_blank"> Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-21" href="https://us-cert.cisa.gov/ncas/alerts/aa20-239a" target="_blank"> DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-22" href="https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/" target="_blank"> CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-23" href="https://telefonicatech.com/blog/snip3-investigacion-malware" target="_blank"> Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-24" href="https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf" target="_blank"> Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-25" href="https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/" target="_blank"> Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-26" href="https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners" target="_blank"> Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-27" href="https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf" target="_blank"> Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-28" href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf" target="_blank"> Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-29" href="https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62" target="_blank"> Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-30" href="https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/" target="_blank"> Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-31" href="https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/" target="_blank"> M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-32" href="https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/" target="_blank"> Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-33" href="https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf" target="_blank"> Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-34" href="https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf" target="_blank"> Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-35" href="https://research.checkpoint.com/2020/bandook-signed-delivered/" target="_blank"> Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-36" href="https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/" target="_blank"> Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-37" href="https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles" target="_blank"> Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-38" href="https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf" target="_blank"> Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-39" href="https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/" target="_blank"> Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-40" href="https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html" target="_blank"> Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-41" href="https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/" target="_blank"> Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-42" href="https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/" target="_blank"> Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-43" href="https://blog.cyble.com/2022/05/06/black-basta-ransomware/" target="_blank"> Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved March 7, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-44" href="https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware" target="_blank"> Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-45" href="https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/" target="_blank"> Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-46" href="https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape" target="_blank"> Demboski, M., et al. (2021, October 26). China cyber attacks: the current threat landscape. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-47" href="https://github.com/BloodHoundAD/BloodHound" target="_blank"> Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-48" href="https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/" target="_blank"> CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-49" href="https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/" target="_blank"> Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-50" href="https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/" target="_blank"> Chell, D. PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-51" href="https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming" target="_blank"> Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-52" href="https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056" target="_blank"> Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-53" href="https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html" target="_blank"> Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-54" href="https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf" target="_blank"> Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-55" href="https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf" target="_blank"> Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-56" href="https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf" target="_blank"> Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-57" href="https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/" target="_blank"> Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-58" href="https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf" target="_blank"> Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-59" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/" target="_blank"> Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-60" href="https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware" target="_blank"> Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-61" href="https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf" target="_blank"> Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-62" href="https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf" target="_blank"> Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-63" href="https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf" target="_blank"> Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-64" href="https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf" target="_blank"> Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-65" href="https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware" target="_blank"> Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-66" href="https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/" target="_blank"> Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-67" href="https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced" target="_blank"> The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-68" href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf" target="_blank"> Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-69" href="https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf" target="_blank"> NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-70" href="https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/" target="_blank"> Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-71" href="https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign" target="_blank"> Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-72" href="https://www.secureworks.com/research/darktortilla-malware-analysis" target="_blank"> Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-73" href="https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/" target="_blank"> Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-74" href="https://www.mandiant.com/resources/apt41-us-state-governments" target="_blank"> Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-75" href="https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf" target="_blank"> Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-76" href="https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider" target="_blank"> Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-77" href="https://github.com/TheWover/donut" target="_blank"> TheWover. (2019, May 9). donut. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-78" href="https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf" target="_blank"> ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-79" href="https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/" target="_blank"> Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-80" href="https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/" target="_blank"> Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-81" href="https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/" target="_blank"> Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-82" href="https://github.com/PowerShellEmpire/Empire" target="_blank"> Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-83" href="https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/" target="_blank"> Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-84" href="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf" target="_blank"> Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-85" href="https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" target="_blank"> Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-86" href="https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech" target="_blank"> Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-87" href="https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/" target="_blank"> Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-88" href="https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf" target="_blank"> Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-89" href="https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/" target="_blank"> Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-90" href="https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant" target="_blank"> Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-91" href="https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/" target="_blank"> Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-92" href="https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/" target="_blank"> Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-93" href="https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/" target="_blank"> ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-94" href="https://www.group-ib.com/blog/grimagent/" target="_blank"> Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-95" href="https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4" target="_blank"> Salem, E. (2021, April 19). Dancing With Shellcodes: Cracking the latest version of Guloader. Retrieved July 7, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-96" href="https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html" target="_blank"> Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-97" href="https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html" target="_blank"> Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-98" href="https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack" target="_blank"> Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-99" href="https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/" target="_blank"> Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-100" href="https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine" target="_blank"> ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-101" href="https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware" target="_blank"> Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-102" href="https://www.zscaler.com/blogs/security-research/return-higaisa-apt" target="_blank"> Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-103" href="https://www.us-cert.gov/ncas/analysis-reports/ar20-045d" target="_blank"> US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-104" href="https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/" target="_blank"> Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-105" href="https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity" target="_blank"> Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-106" href="https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware" target="_blank"> Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-107" href="https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html" target="_blank"> PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-108" href="https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/" target="_blank"> QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-109" href="https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf" target="_blank"> Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-110" href="https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/" target="_blank"> ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018. </a> </li> </ol> </div> <div class="col"> <ol start="111.0"> <li> <a rel="nofollow" class="external text" name="scite-111" href="https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf" target="_blank"> Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-112" href="https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf" target="_blank"> Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-113" href="https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html" target="_blank"> Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-114" href="https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf" target="_blank"> Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-115" href="https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/" target="_blank"> Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-116" href="https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus" target="_blank"> Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-117" href="https://www.bitsight.com/blog/latrodectus-are-you-coming-back" target="_blank"> Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-118" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27" target="_blank"> Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-119" href="https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/" target="_blank"> Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-120" href="https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns" target="_blank"> Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-121" href="https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf" target="_blank"> Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-122" href="https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044" target="_blank"> Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-123" href="https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319" target="_blank"> BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-124" href="https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html" target="_blank"> Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-125" href="https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/" target="_blank"> M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-126" href="https://objective-see.org/blog/blog_0x69.html" target="_blank"> Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-127" href="https://assets.sentinelone.com/sentinellabs22/metador#page=1" target="_blank"> Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-128" href="https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/" target="_blank"> GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-129" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/" target="_blank"> Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-130" href="https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/" target="_blank"> Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-131" href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage" target="_blank"> Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-132" href="https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm" target="_blank"> SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-133" href="https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767" target="_blank"> Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-134" href="https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions" target="_blank"> Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-135" href="https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/" target="_blank"> Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-136" href="https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf" target="_blank"> Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-137" href="https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/" target="_blank"> Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-138" href="https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/" target="_blank"> SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-139" href="https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf" target="_blank"> ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-140" href="https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf" target="_blank"> Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-141" href="https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/" target="_blank"> Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-142" href="https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing" target="_blank"> Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-143" href="https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" target="_blank"> Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-144" href="https://securelist.com/toddycat/106799/" target="_blank"> Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-145" href="https://securelist.com/toddycat-keep-calm-and-check-logs/110696/" target="_blank"> Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-146" href="https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/" target="_blank"> Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-147" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/" target="_blank"> Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-148" href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf" target="_blank"> Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-149" href="https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf" target="_blank"> Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-150" href="https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot" target="_blank"> Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-151" href="https://www.elastic.co/security-labs/pikabot-i-choose-you" target="_blank"> Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-152" href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/" target="_blank"> Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-153" href="https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/" target="_blank"> Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-154" href="https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/" target="_blank"> Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-155" href="http://labs.lastline.com/an-analysis-of-plugx" target="_blank"> Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-156" href="https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european" target="_blank"> Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-157" href="https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/" target="_blank"> hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-158" href="https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/" target="_blank"> MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-159" href="https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/" target="_blank"> Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-160" href="https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot" target="_blank"> Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-161" href="https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" target="_blank"> Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-162" href="https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/" target="_blank"> Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-163" href="https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf" target="_blank"> Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-164" href="https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html" target="_blank"> Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-165" href="https://www.secureworks.com/research/revil-sodinokibi-ransomware" target="_blank"> Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-166" href="https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/" target="_blank"> Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-167" href="https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/" target="_blank"> Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-168" href="https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/" target="_blank"> Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-169" href="https://www.cybereason.com/blog/royal-ransomware-analysis" target="_blank"> Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-170" href="https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf" target="_blank"> Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-171" href="https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/" target="_blank"> Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-172" href="https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/" target="_blank"> Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-173" href="https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/" target="_blank"> Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-174" href="https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf" target="_blank"> Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-175" href="https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf" target="_blank"> Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-176" href="https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure" target="_blank"> Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-177" href="https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/" target="_blank"> Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-178" href="https://securelist.com/the-silence/83009/" target="_blank"> GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-179" href="https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA." target="_blank"> Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-180" href="https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo" target="_blank"> Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-181" href="https://unit42.paloaltonetworks.com/siloscape/" target="_blank"> Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-182" href="https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/" target="_blank"> GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-183" href="https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations" target="_blank"> Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-184" href="https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf" target="_blank"> Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 </a> </li> <li> <a rel="nofollow" class="external text" name="scite-185" href="https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/" target="_blank"> CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-186" href="https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/" target="_blank"> Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-187" href="https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/" target="_blank"> Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-188" href="https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging" target="_blank"> Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-189" href="https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html" target="_blank"> Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-190" href="https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory=" target="_blank"> Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-191" href="http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf" target="_blank"> Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-192" href="https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a" target="_blank"> CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-193" href="https://objective-see.com/blog/blog_0x60.html" target="_blank"> Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-194" href="https://blog.talosintelligence.com/2021/09/tinyturla.html" target="_blank"> Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-195" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/" target="_blank"> Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-196" href="https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf" target="_blank"> Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-197" href="https://www.joesecurity.org/blog/498839998833561473" target="_blank"> Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-198" href="https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf" target="_blank"> Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-199" href="https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/" target="_blank"> Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-200" href="https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf" target="_blank"> FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-201" href="https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html" target="_blank"> Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-202" href="https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF" target="_blank"> US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-203" href="https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique" target="_blank"> Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-204" href="https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/" target="_blank"> Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-205" href="https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html" target="_blank"> Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-206" href="https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html" target="_blank"> Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-207" href="https://www.recordedfuture.com/research/whispergate-malware-corrupts-computers-ukraine" target="_blank"> Insikt Group. (2020, January 28). WhisperGate Malware Corrupts Computers in Ukraine. Retrieved September 16, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-208" href="https://objective-see.com/blog/blog_0x3D.html" target="_blank"> Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-209" href="https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf" target="_blank"> Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-210" href="https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild" target="_blank"> MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-211" href="https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/" target="_blank"> Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-212" href="https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html" target="_blank"> Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-213" href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction" target="_blank"> Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-214" href="http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599" target="_blank"> Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-215" href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control" target="_blank"> Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-216" href="https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html" target="_blank"> Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-217" href="https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm" target="_blank"> NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-218" href="https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)" target="_blank"> Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024. </a> </li> <li> <a rel="nofollow" class="external text" name="scite-219" href="https://technet.microsoft.com/en-us/library/ee791851.aspx" target="_blank"> Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016. </a> </li> </ol> </div> </div> </div> </div> </div> </div> </div> </div>   <div class="overlay search" id="search-overlay" style="display: none;"> <div class="overlay-inner">  <div class="search-header"> <div class="search-input"> <input type="text" id="search-input" placeholder="search"> </div> <div class="search-icons"> <div class="search-parsing-icon spinner-border" style="display: none" id="search-parsing-icon"></div> <div class="close-search-icon" id="close-search-icon">×</div> </div> </div>  <div id="search-body" class="search-body"> <div class="results" id="search-results">  </div> <div id="load-more-results" class="load-more-results"> <button class="btn btn-default" id="load-more-results-button">load more results</button> </div> </div> </div> </div> </div> <div class="row flex-grow-0 flex-shrink-1">  <footer class="col footer"> <div class="container-fluid"> <div class="row row-footer"> <div class="col-2 col-sm-2 col-md-2"> <div class="footer-center-responsive my-auto"> <a href="https://www.mitre.org" target="_blank" rel="noopener" aria-label="MITRE"> <img src="/theme/images/mitrelogowhiteontrans.gif" class="mitre-logo-wtrans"> </a> </div> </div> <div class="col-2 col-sm-2 footer-responsive-break"></div> <div class="footer-link-group"> <div class="row row-footer"> <div class="px-3 col-footer"> <a href="/resources/engage-with-attack/contact" class="footer-link">Contact Us</a> </div> <div class="px-3 col-footer"> <a href="/resources/legal-and-branding/terms-of-use" class="footer-link">Terms of Use</a> </div> <div class="px-3 col-footer"> <a href="/resources/legal-and-branding/privacy" class="footer-link">Privacy Policy</a> </div> <div class="px-3"> <a href="/resources/changelog.html" class="footer-link" data-toggle="tooltip" data-placement="top" data-html="true" title="ATT&CK content v16.1Website v4.2.1">Website Changelog</a> </div> </div> <div class="row"> © 2015 - 2024, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. </div> </div> <div class="w-100 p-2 footer-responsive-break"></div> <div class="col pr-4"> <div class="footer-float-right-responsive-brand"> <div class="row row-footer row-footer-icon"> <div class="mb-1"> <a href="https://twitter.com/MITREattack" class="btn btn-footer"> </a> <a href="https://github.com/mitre-attack" class="btn btn-footer"> </a> </div> </div> </div> </div> </div> </div> </div> </footer> </div> </div>  </div>  <script src="/theme/scripts/jquery-3.5.1.min.js"></script> <script src="/theme/scripts/popper.min.js"></script> <script src="/theme/scripts/bootstrap-select.min.js"></script> <script src="/theme/scripts/bootstrap.bundle.min.js"></script> <script src="/theme/scripts/site.js"></script> <script src="/theme/scripts/settings.js"></script> <script src="/theme/scripts/search_bundle.js"></script>  <script src="/theme/scripts/resizer.js"></script>  <script src="/theme/scripts/bootstrap-tourist.js"></script> <script src="/theme/scripts/settings.js"></script> <script src="/theme/scripts/tour/tour-techniques.js"></script> <script src="/theme/scripts/sidebar-load-all.js"></script> </body> </html>

CINXE.COM

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®