Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
Victims count: 783
Last discovered victim 2025-05-15
First discovered victims: 2023-04-26
Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
---|---|---|---|---|---|---|---|
Advanced IP Scanner
Masscan
ReconFTW
SharpHound
SoftPerfect NetScan
|
AnyDesk
MobaXterm
Radmin
RustDesk
|
PowerTool
Zemana Anti-Rootkit driver
|
DonPAPI
LaZagne
Mimikatz
|
Impacket
|
Cloudflared
OpenSSH
Ngrok
|
|
FileZilla
MEGA
RClone
Temp[.]sh
WinSCP
|
Vendor | Product | CVE | Source |
---|---|---|---|
Cisco | ASA & FTD | CVE-2023-20269 | cisco.com |
Cisco | ASA & FTD | CVE-2023-20263 | blog.talosintelligence.com |
Cisco | ASA & FTD | CVE-2020-3259 | cisa.gov |
Fortinet | FortiOS | CVE-2022-40684 | stairwell.com |
Fortinet | FortiOS | CVE-2019-6693 | stairwell.com |
Fortinet | FortiClient | CVE-2023-48788 | blog.talosintelligence.com |
SonicWall | SonicOS SSL-VPN | CVE-2024-40766 | arcticwolf.com |
Veeam | Backup & Replication | CVE-2024-40711 | @SophosXOps |
Veeam | Backup & Replication | CVE-2023-27532 | sophos.com |
VMware | ESXi | CVE-2024-37085 | microsoft.com |
VMware | vSphere Client | CVE-2021-21972 | qualys.com |
Initial Access | Persistence | Privilege Escalation | Execution | Defense Evasion | Credential Access | Discovery | Command and Control | Lateral Movement | Collection | Exfiltration | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|
Valid Accounts | Create Account: Domain Account | Valid Accounts: Domain Accounts | Command and Scripting Interpreter | Impair Defenses: Disable or Modify Tools | OS Credential Dumping: LSASS Memory | System Information Discovery | Remote Access Software | Lateral Tool Transfer | Archive Collected Data: Archive via Utility | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Inhibit System Recovery |
Valid Accounts: Domain Accounts | Create Account: Local Account | Privilege Escalation | Command and Scripting Interpreter: PowerShell | Modify Registry | Discovery | Remote Services: Remote Desktop Protocol | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol | Data Encrypted for Impact | |||
External Remote Services | System Services: Service Execution | Remote System Discovery | |||||||||
Exploit Public-Facing Application | Command and Scripting Interpreter: Windows Command Shell | ||||||||||
Windows Management Instrumentation |