Volt Typhoon

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation:

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised syste

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as w

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to l

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of detail

Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety o

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of

Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a

Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about busi

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in nu

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citat

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line int

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

VersaMem is a web shell designed for deployment to Versa Director servers following exploitation. Discovere

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event

certutil is a command-line utility that can be used to obtain certificate authority information and configu

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other pro

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat

netstat is an operating system utility that displays active TCP connections, listening ports, and network s

KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) eq

Versa Director Zero Day Exploitation was conducted by [Volt Typhoon](https://attack.mitre.org/groups/G1017