Automated Collection

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.^[1]

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.^[2]

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.^[3]

Attor has automatically collected data about the compromised system.^[4]

BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.^[5]

Bankshot recursively generates a list of files within a directory and sends them back to the control server.^[6]

Chimera has used custom DLLs for continuous retrieval of data from memory.^[7]

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.^[8]

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.^[9]

Crutch can automatically monitor removable drives in a loop and copy interesting files.^[10]

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.^[11]

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.^[12][13]

Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.^[14]

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.^[15]

GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.^[16]

A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.^[17]

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.^[18][19]

Ke3chang has performed frequent and scheduled data collection from victim networks.^[20]

LightNeuron can be configured to automatically collect files under a specified directory.^[21]

menuPass has used the Csvde tool to collect Active Directory files and data.^[22]

MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.^[23]

Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.^[24]

Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).^[25]

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.^[26]

Mythic supports scripting of file downloads from agents.^[27]

NETWIRE can automatically archive collected data.^[28]

OilRig has used automated collection.^[29]

Operation Wocao has used a script to collect information about the infected system.^[30]

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.^[5]

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.^[31]

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.^[32]

Proxysvc automatically collects data about the victim and sends it to the control server.^[33]

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.^[34]

ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.^[35]

Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.^[36]

RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.^[37][38]

ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.^[39]

Sidewinder has used tools to automatically collect system and network configuration information.^[40]

StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.^[41]

T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, .ppt, .xls, .docx, .pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.^[42]

TajMahal has the ability to index and compress files into a send queue for exfiltration.^[43]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[44]

Tropic Trooper has collected information automatically using the adversary's USBferry attack.^[45]

For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.^[46]

Valak can download a module to search for and build a report of harvested credential data.^[47]

VERMIN saves each collected file with the automatically generated format {{0:dd-MM-yyyy}}.txt .^[48]

WindTail can identify and add files that possess specific file extensions to an array for archiving.^[49]

Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.^[50][51]

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means. Strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through Brute Force techniques.

Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means.