See Your Attack Surface Before Adversaries Do.

User Execution: Malicious File

[APT-88] Victims are lured via graduation invitation decoys into mounting Virtual Hard Disk (VHD) containers to deliver the Go-based QUICAgent backdoor.

Command and Scripting Interpreter: Unix Shell

[UNC-4109] Threat actors employ ClickFix social engineering to trick macOS and Linux users into executing curl payload stagers from interactive zsh Terminal sessions.

Exploit Public-Facing Application

[APT-71] Actors exploit edge network infrastructure vulnerabilities such as Ivanti Connect Secure and Fortinet FortiClient EMS to establish network footholds.

Command and Scripting Interpreter: Windows Command Shell

[APT-71] Operators leverage native cmd.exe invocations for living-off-the-land discovery of Domain Admins and staging payloads across shared admin shares.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[APT-71] Malware establishes user persistence by appending malicious executable paths directly to HKCU Software Microsoft Windows CurrentVersion Run keys.

Supply Chain Compromise: Compromise Software Dependencies

[UNC-2834] Adversaries publish contaminated open-source packages containing obfuscated infostealer modules into public software package repositories.

Application Layer Protocol: Web Protocols

[UNC-9122] Operators deploy high-frequency rotating domain infrastructure utilizing recurring REST-like URI request paths and custom headers to evade static perimeter blocking.

Data Encrypted for Impact

[UNC-6031] Autonomous ransomware operators rapidly traverse target environments and initiate dual encryption routines with minimal human interaction.

Phishing: Spearphishing Link

[APT-42] Attackers target corporate recruiters using fraudulent professional opportunities embedded with weaponized document download links.

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

[UNC-7714] Intruders stage sensitive directories using command-line archiving before pushing multi-part archives outward using standard HTTP post commands.

User Execution: Malicious File

[APT-88] Victims are lured via graduation invitation decoys into mounting Virtual Hard Disk (VHD) containers to deliver the Go-based QUICAgent backdoor.

Command and Scripting Interpreter: Unix Shell

[UNC-4109] Threat actors employ ClickFix social engineering to trick macOS and Linux users into executing curl payload stagers from interactive zsh Terminal sessions.

Exploit Public-Facing Application

[APT-71] Actors exploit edge network infrastructure vulnerabilities such as Ivanti Connect Secure and Fortinet FortiClient EMS to establish network footholds.

Command and Scripting Interpreter: Windows Command Shell

[APT-71] Operators leverage native cmd.exe invocations for living-off-the-land discovery of Domain Admins and staging payloads across shared admin shares.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[APT-71] Malware establishes user persistence by appending malicious executable paths directly to HKCU Software Microsoft Windows CurrentVersion Run keys.

Supply Chain Compromise: Compromise Software Dependencies

[UNC-2834] Adversaries publish contaminated open-source packages containing obfuscated infostealer modules into public software package repositories.

Application Layer Protocol: Web Protocols

[UNC-9122] Operators deploy high-frequency rotating domain infrastructure utilizing recurring REST-like URI request paths and custom headers to evade static perimeter blocking.

Data Encrypted for Impact

[UNC-6031] Autonomous ransomware operators rapidly traverse target environments and initiate dual encryption routines with minimal human interaction.

Phishing: Spearphishing Link

[APT-42] Attackers target corporate recruiters using fraudulent professional opportunities embedded with weaponized document download links.

Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

[UNC-7714] Intruders stage sensitive directories using command-line archiving before pushing multi-part archives outward using standard HTTP post commands.