cisa.gov/uscert/ncas/alerts

• #StopRansomware: SafePay Ransomware

  Advisory at a Glance

  Title	#StopRansomware: SafePay Ransomware
  Original Publication	October 20, 2026
  Executive Summary	This advisory details recent activity by the SafePay ransomware group. SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics.  Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones. They then use legitimate system tools to move through the network, identify valuable files, and disable security protections to avoid detection. Next, they encrypt the victim’s files, making them inaccessible, and leave a ransom note demanding payment in cryptocurrency. This advisory urges organizations to follow recommended security measures to reduce the risk and impact of SafePay ransomware attacks.
  Affected Products	CVE-2020-3259 [Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor] CVE-2023-20269 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function] CVE-2024-40711 [CWE-502: Deserialization of Untrusted Data] CVE-2024-40766 [CWE-284: Improper Access Control]
  Key Actions	Regularly patch and update systems, especially firewalls, and other edge devices. Implement Zero Trust Principle. Restrict administrative tools and privileges to necessary users only. Strengthen account security by implementing identity, credential, and access management (ICAM) policies and multifactor authentication (MFA).
  Indicators of Compromise	For a downloadable copy of indicators of compromise, see:  AA26-293A STIX XML (40 KB) AA26-293A STIX JSON (38 KB)
  Intended Audience	Organizations:Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure Roles: Defensive cybersecurity analysts, vulnerability analysts, security systems managers, and operational technology (OT) owners and operators

  Introduction

  Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. 

  The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), United States Secret Service (USSS), Germany’s Landeskriminalamt Rheinland-Pfalz, the United Kingdom’s National Crime Agency, and the United Kingdom’s North West Regional Organised Crime Unit—hereafter referred to as the authoring agencies—are releasing this joint advisory to disseminate known SafePay ransomware TTPs and IOCs identified through FBI, USSS, and Landeskriminalamt Rheinland-Pfalz investigations as recently as August 2026.

  Since August 2024, SafePay ransomware group’s operations have affected a wide range of businesses and critical infrastructure in North America, South America, Europe, and Australia. SafePay ransomware was among the most active ransomware groups in 2026. The SafePay threat actors have impacted at least 600 separate victims from multiple critical infrastructure sectors.

  The authoring agencies encourage organizations to implement the recommendations in the Mitigationssection of this advisory to reduce the likelihood and impact of SafePay ransomware incidents.

  Download the PDF version of this report:

  #StopRansomware: SafePay Ransomware (PDF, 1.06 MB )

  For a downloadable copy of IOCs, see:

  AA26-293A-STIX XML (XML, 40.23 KB )

  AA26-293A-STIX JSON (JSON, 37.49 KB )

  Technical Details

  Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 20. SeeMITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

  Initial Access

  The FBI, USSS, and cybersecurity researchers observed SafePay threat actors obtaining initial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access. SafePay threat actors use the IP addresses of the VPN provider “Mullvad” to attain initial access—specifically, SafePay threat actors use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products:

  • CVE-2020-3259 [Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor]
  • CVE-2023-20269 [CWE-288: Authentication Bypass Using an Alternate Path or Channel] 

  Additionally, the authoring agencies observed SafePay threat actors exploiting the following vulnerabilities across internet-exposed systems [T1190] for initial access through automated scripts:

  • CVE-2023-27532 [CWE-306: Missing Authentication for Critical Function]
  • CVE-2024-40711 [CWE-502: Deserialization of Untrusted Data]
  • CVE-2024-40766 [CWE-284: Improper Access Control]

  Execution, Persistence, Stealth, and Defense Impairment

  After SafePay threat actors gain access to a victim network, they establish persistence by gaining administrative privileges on existing accounts [T1098], or on newly created accounts [T1136], using built-in administrative tools consistent with living off the land (LOTL) techniques. Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [T1218], such as PsExec [T1021.002] and Windows Remote Management (WinRM) [T1021.006], to execute commands on remote systems. In several instances, SafePay threat actors used ShareFinder.ps1—a PowerShell script function used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [T1059.001, T1059.003]. Additionally, SafePay threat actors used SharpShares.exe, a tool used to identify and enumerate network file shares.

  As SafePay threat actors prepare for lateral movement, they commonly disable security software [T1685] to avoid detection. In some cases, the threat actors changed the passwords of system users, making valid logins impossible. SafePay threat actors have also been observed using software packing or virtual machine software protection to conceal their code [T1027.002].

  Privilege Escalation

  The authoring agencies observed SafePay threat actors using a User Account Control (UAC) Bypass Privilege Escalation technique [T1548.002] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [T1059]. SafePay threat actors have also been observed using token impersonation methods [T1134.001].

  Lateral Movement

  To pivot laterally through a network and identify files for exfiltration [TA0010] and encryption, SafePay threat actors use legitimate tools like PsExec, WinRM, and Remote Management and Monitoring [T1569.002] software. They also employ Remote Desktop Protocol (RDP) [T1021.001, T1133] to expand their presence within the compromised network [T1021]. As SafePay threat actors move laterally through a network, they look for credentials to gain admin access and will create accounts, if needed.

  Collection, Exfiltration, and Impact

  SafePay threat actors use legitimate tools, such as FileZilla, 7-Zip, RClone, and WinRAR to compress files and collect data [T1560.001], and WinSCP and RClone to facilitate the exfiltration of data [T1048] from the compromised network to actor-controlled accounts. In some instances, SafePay threat actors use OneDrive to exfiltrate data [T1567]. In other instances, the SafePay threat actors installed legitimate remote desktop tools like AnyDesk or TeamViewer on the victim’s systems. SafePay threat actors use these tools to transfer ransomware and other software onto a victim’s system. Additionally, SafePay threat actors halt the Volume Shadow Copy Service and reset Network Attached Storage containing victim backup data to initial factory settings to inhibit system recovery attempts [T1490].

  Following exfiltration, SafePay threat actors encrypt files [T1486] using a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange. This multilayered approach customizes encryption methods based on file type and size and enables full or partial encryption. Data encrypted with the SafePay ransomware variant (appended with .SafePay) cannot be recovered without the decryption key. SafePay threat actors hold the encrypted data for ransom and typically demand a subset of company revenue in cryptocurrency in exchange for decryption software. SafePay threat actors leave a ransom note on the victim’s system, typically on the desktop or root directory, advising them that SafePay locked their system and to reach out over a chat portal at a TOR .onion website link with a victim ID as the login. To put pressure on the victim, a representative makes phone calls on behalf of the ransomware group. If the victim does not pay, SafePay posts the exfiltrated data to their SafePay leak website, which is linked in the ransom note. Following encryption, SafePay may delete itself from the victim’s filesystem [T1070.004].

  Leveraged Tools

  Table 1lists publicly available tools and applications used by SafePay threat actors, including legitimate tools repurposed for their operations.
  Note:These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

  Table 1. Tools Leveraged by SafePay Threat Actors

  Tool Name	Description
  7-Zip	An open source software that enables users to compress various file formats. SafePay threat actors maliciously use 7-Zip for data packaging and movement.
  FileZilla	An open source client that enables users to transfer files between servers. SafePay threat actors use FileZilla maliciously for data exfiltration.
  Mimikatz	A credential dumper that enables users to view and save authentication credentials, such as Kerberos tickets [T1550.002]. SafePay threat actors use Mimikatz for password exfiltration.
  PowerShell	A cross-platform task automation solution used for various malicious activities, including command execution. It is composed of a command-line shell, a scripting language, and a configuration management framework—which runs on Windows, Linux, and macOS.
  PsExec	A tool designed to run programs that SafePay threat actors use to execute commands on remote systems.
  RClone	A legitimate command-line program used to sync files with cloud storage services, such as Mega. SafePay threat actors maliciously use RClone for data packaging and movement.
  ScreenConnect	A remote support, access, and meeting software that allows users to control devices remotely over the internet. SafePay threat actors use ScreenConnect for persistence and access.
  ShareFinder.ps1	A PowerShell script used to scan an Active Directory network for shared folders. SafePay threat actors use ShareFinder.ps1 for exfiltration hunting.
  WinRAR	Archive utility used to split compromised data into segments and to compress [T1560.001] files into a .RAR format prior to exfiltration. SafePay threat actors use WinRAR for data packaging and movement.
  WinRM	A Windows-based protocol designed to facilitate remote management and automation. SafePay threat actors use WinRM for command execution.
  AnyDesk and TeamViewer	Legitimate remote desktop tool used for accessing and controlling computers over the internet. SafePay threat actors use AnyDesk and TeamViewer to transfer malware to the victim’s system.
  AcronisDiskDirector	A legitimate disk management tool.
  SharpShares.exe	A network scanning tool used for host discovery and enumeration.
  NetExec	A legitimate network assessment tool to enumerate systems, validate credentials, and manage remote operations across private networks.
  Backblaze	A command-line tool for file management within Backblaze B2 cloud storage. SafePay threat actors executed commands via b2.exe to exfiltrate a victim’s data.

  Indicators of Compromise

  Table 2 through Table 5 list IOCs associated with SafePay ransomware that allowed for the identification of malicious activity.
  Disclaimer: The authoring agencies recommend organizations investigate or verify IP addresses prior to taking action, such as blocking. These IOCs were observed between November 2024 and August 2026.

  Table 2. IP Addresses

  IP Address	Description
  104.26.2[.]223	SafePay victim intrusion
  140.82.114[.]4	SafePay victim intrusion
  185.199.108[.]133	SafePay victim intrusion
  77.37.49[.]40	SafePay victim intrusion
  173.194.194[.]94	Hosting victim data
  167.235.225[.]149	Client login panels
  5.255.11[.]134	Used in exfiltration
  88.119.167[.]239	soc.dll command and control
  37.10.71[.]188	Used in exfiltration

  
  Note: Some of these files are legitimate tools. The authoring organizations recommend organizations investigate or verify tool use prior to taking action, such as blocking.

  Table 3. Malicious Files

  Filename	Description
  1 - Copy.bat	A batch script likely used to copy, stage, or move files during lateral movement or data collection.
  CCleaner.exe/ CCleaner64.exe	A legitimate system utility; however, it is suspicious if deployed in enterprise environments for file cleanup or anti-forensics.
  CCleaner*.exe / *.dll	A file used for potential masquerading or abuse of CCleaner components for execution or persistence.
  dcsync.exe	A tool used to perform DCSync operations to extract Active Directory credentials; high-confidence credential theft activity.
  domains.txt	An output file likely containing enumerated domain information.
  DYRasWtb.exe	A suspected malicious executable.
  libsmb2.dll	A library associated with Server Message Block (SMB) communication; may support lateral movement or file transfer.
  Libwa*.dll	A suspicious library set; likely part of a custom toolset or malware framework; requires further analysis.
  License.txt	A benign file that may accompany tool packages or be used for masquerading. In one instance, it accompanied the tool “S.P_Network Scanner.”
  locker.dll	A potential ransomware or encryption-related component.
  netscan.exe	A network scanning tool used for host discovery and enumeration.
  netscan.lic / netscan.xml	Output or configuration files associated with network scanning activity.
  netscanNEW.zip	Archive file potentially used to stage or transfer scanning tools.
  nltest.exe	Legitimate Windows tool used for domain trust enumeration; suspicious when used outside admin workflows.
  oui.txt	A MAC address vendor lookup output—network reconnaissance artifact.
  ping.txt	An output file from network connectivity testing.
  portable.dat	A potential configuration or staging file (context-dependent).
  scan.xml	An output file from scanning/enumeration tools.
  sharefinder.ps1	A PowerShell script used to enumerate network shares (reconnaissance).
  Socks.exe	A tool used to establish SOCKS proxy for tunneling traffic.
  Socks_werfault.exe	A binary likely masquerading to blend with Windows processes.
  subs.txt	A possible staging file or list of targets/data for exfiltration.
  svchost.exe	A legitimate Windows process; suspicious if located outside System32 or used for masquerading.
  wa_3rd_party_host_*.exe	A file of suspicious binaries—likely part of SafePay threat actor toolset or masquerading components.
  winrar.exe	A legitimate archiving tool frequently used for data staging prior to exfiltration.
  AnyDesk.exe	A legitimate remote desktop tool for accessing and controlling computers over the internet; most of the time it is used to transfer malware to a victim’s system.
  SharpShares.exe	A network scanning tool used for host discovery and enumeration.
  AcronisDiskDirector-12.5 / acro.exe / DiskDirector.exe / Acronis.exe	A legitimate disk management tool.
  b2.exe	A command-line tool for data exfiltration to Backblaze B2 cloud storage.
  nxc.exe	The executable for NetExec, a legitimate network assessment tool used to enumerate systems, validate credentials, and manage remote operations across private networks.

  Table 4. SHA-1 Hash Values

  Hash	File/Description
  07353237350c35d6dc2c8f143b649cd07c71f62b	1.exe (ransomware binary)
  b498a2683640c983bb069fa2ea9e67cef4a3797d	Locker.dll PE32 executable
  BBFED53E3BB1F306F4DA97D995CF4AE5B73AD081	locker.dll
  d711a5af5aed48a3b36b98f4fcf52809aebef7a2	nxc

  Table 5. SHA-256 Hash Files

  Hash	File/Description
  921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae	soc.dll
  6c1d36df94ebe367823e73ba33cfb4f40756a5e8ee1e30e8f0ae55d47e220a6a	RunPE bundled DLL
  e79608cf1d6b51324c14bef8883054c1238ed5f080222cc464810e6e14adc346	Injected PE
  327b8b61eb446cc4f710771e44484f62b804ae3d262b57a56575053e2df67917	locker.dll PE32 executable
  a0dc80a37eb7e2716c02a94adc8df9baedec192a77bde31669faed228d9ff526	locker.dll
  BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41	SharpShares.exe

  The following are IOC hostnames:

  • WIN-SBOE3CPNAL
  • WIN-3IUUOFVTQAR
  • WIN-DK18BI83M0S
  • WIN-I1HRRJHCEIV

  MITRE ATT&CK Tactics and Techniques 

  See Table 6 through Table 16for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool. 

  Table 6. Initial Access

  Technique Title	ID	Use
  External Remote Services	T1133	SafePay threat actors use external remote services, such as VPNs or other tools, to externally connect to an internal network.
  Exploit Public-Facing Application	T1190	SafePay threat actors attempt to exploit a vulnerability within a system to gain access. Common vulnerabilities include software bugs, glitches, or misconfigurations.

  Table 7. Execution

  Technique Title	ID	Use
  Command and Scripting Interpreter: PowerShell	T1059.001	SafePay threat actors use PowerShell, an interactive command-line interface and scripting environment contained within Windows, to identify code within a targeted network.
  Command and Scripting Interpreter: Windows Command Shell	T1059.003	SafePay threat actors use the Windows command shell prompt to gain control of a component on a system that requires specific permissions depending on the command executed.
  System Services: Service Execution	T1569.002	SafePay threat actors use tools, such as PsExec, to execute commands on remote systems.
  Command and Scripting Interpreter	T1059	SafePay threat actors use Windows UAC to elevate a program’s privileges, enabling the execution of malicious commands or binaries.

  Table 8. Persistence

  Technique Title	ID	Use
  Account Manipulation	T1098	SafePay threat actors establish persistence by gaining administrative privileges on existing accounts.

  Table 9. Privilege Escalation

  Technique Title	ID	Use
  Abuse Elevation Control Mechanism: Bypass User Account Control	T1548.002	SafePay threat actors use Windows UAC to elevate a program’s privileges and execute a task on an administrator-level permission scale.

  Table 10. Stealth

  Technique Title	ID	Use
  Obfuscated Files or Information: Software Packing	T1027.002	SafePay threat actors use software packing to conceal malicious code by means of encrypting an executable to avoid detection.
  Indicator Removal: File Deletion	T1070.004	SafePay threat actors delete files associated with the intrusion activity to minimize their digital footprint and obfuscate malicious activities.
  System Binary Proxy Execution	T1218	SafePay threat actors proxy the execution of malicious content with a trusted binary, often a Microsoft-signed file, to bypass signature-based network defenses.

  Table 11. Defense Impairment

  Technique Title	ID	Use
  Disable or Modify Tools	T1685	SafePay threat actors disable security features, modify or delete registry keys or configuration files to impair functionality, and disable updates such as security patches on a system or network.

  Table 12. Credential Access

  Technique Title	ID	Use
  Brute Force	T1110	SafePay threat actors gain access to accounts by implementing brute force password attacks.

  Table 13. Lateral Movement

  Technique Title	ID	Use
  Remote Services: Remote Desktop Protocol	T1021.001	SafePay threat actors gain access to a valid account using RDP and typically disable cybersecurity features, such as Windows Defender, while using LOLBins.
  Remote Services: SMB/Windows Admin Shares	T1021.002	SafePay threat actors gain access to a valid account using SMB to enable lateral movement throughout a network.
  Remote Services	T1021	SafePay threat actors employ remote services to expand their presence within the compromised network.
  Remote Services: Windows Remote Management	T1021.006	SafePay threat actors use tools, such as WinRM, to execute commands on remote systems.

  Table 14. Collection

  Technique Title	ID	Use
  Archive Collected Data: Archive via Utility	T1560.001	SafePay threat actors use utilities to compress or encrypt collected data prior to exfiltration to change the format of the data to one compatible for transportation.
  Archive Collected Data: Archive via Library	T1560.002	SafePay threat actors use credential dumpers, such as Mimikatz, for password exfiltration.

  Table 15. Exfiltration

  Technique Title	ID	Use
  Exfiltration Over Alternative Protocol	T1048	SafePay threat actors exfiltrate data over an alternative protocol, including file transfer protocol, simple mail transfer protocol, HTTP/S, domain name system, SMB, or another network protocol variation that is not the main or current command and control channel.
  Exfiltration Over Web Service	T1567	SafePay threat actors exfiltrate data over web services, such as OneDrive.

  Table 16. Impact

  Technique Title	ID	Use
  Data Encrypted for Impact	T1486	SafePay threat actors encrypt data on targeted systems to disrupt access to a particular system or network service. They then demand a ransom payment in exchange for a decryption key.
  Inhibit System Recovery	T1490	SafePay threat actors disable services designed to assist in recovery of a corrupted system. In some cases, SafePay threat actors deleted all network-attached backups of company data.

  Incident Response

  If a potential compromise is detected, but ransomware actors have not (yet) encrypted items, organizations should take the following actions:

  1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.
  2. Initiate threat hunting activities to scope the intrusion. Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc.
  3. Report the suspected compromise to the FBI and other agencies as appropriate (if located within the U.K., report the compromise to Report Fraud or local police force) (see the Reportingsection for contact information).
  4. Apply eviction countermeasures, including those listed below, to contain the incident and eradicate the threat actor from the network (Note: Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities). 
     
     1. Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs). 
        
        1. Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool fact sheet.
  5. Harden the network to prevent additional malicious activity (see Mitigations for guidance).

  If compromise is detected and items have been encrypted, see the “Ransomware and Data Extortion Response Checklist” in CISA’s joint #StopRansomware Guide.

  Mitigations

  The authoring agencies recommend organizations implement the mitigations below to improve their cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

  Organizations should implement the following mitigations:

  • Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date, as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; specifically, prioritize patching KEVs in internet-facing systems. [CPG 2.B].
    
    • Additionally, using Binding Operational Directive 26-04 offers a framework for patch prioritization based on technology type and steps for forensics triage. Under its implementation guidance, it offers guidance and steps to perform forensic triage for severe vulnerability cases.
  • Implement identity, credential, and access management (ICAM) policies across the organization and require MFA for all services to the greatest extent possible—particularly for webmail, VPNs, and accounts that access critical systems [CPG 3.F].
  • Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s digital identity guidelines; require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security [CPG 3.B].
    
    • Use longer passwords consisting of at least 15 characters and no more than 64 characters in length.
    • Store passwords in a hashed format using industry-recognized password managers.
    • Add password user “salts” to shared login credentials.
    • Avoid reusing passwords [CPG 3.C].
    • Implement multiple failed login attempt account lockouts [CPG 3.E].
    • Disable password “hints.”
    • Refrain from requiring password changes more frequently than once per year.
      Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher.
  • Maintain offline backups of data and regularly test and maintain backup and restoration processes [CPG 3.O]; implementing this practice helps organizations avoid severe operational interruptions and prevents scenarios in which data is irretrievable.
  • Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [CPG 3.K].
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drives, storage devices, or the cloud) [CPG 3.I, 3.O, 1.C].
  • Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between, and access to, various subnetworks and restrict adversary lateral movement [CPG 3.I].
  • Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool [CPG 4.B].
    
    • To aid in detecting ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.
    • Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.
  • Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems—this prevents threat actors from directly connecting to remote access services that they have established for persistence.
  • Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts.
  • Disable unused ports.
  • Consider adding an email banner to emails received from outside of your organization. 
  • Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [CPG 3.G].
  • Implement time-based access for accounts set at the admin level and higher; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model).
    
    • This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.
    • Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.
  • Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [CPG 3.M].

  These mitigations align with principles provided in the joint guide Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software. CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By implementing secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to make additional configuration changes, purchasing product security add-in software and logs, monitoring, and making frequent security updates.

  Validate Security Controls

  In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

  To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 6 to Table 16).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

  The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

  Resources

  • Stopransomware.gov is a whole-of-government approach that provides one central location for ransomware resources and alerts.
  • CISA’s #StopRansomware Guide provides organizations with comprehensive best practices to mitigate the risk of ransomware attacks.
  • CISA’s Known Exploited Vulnerabilities Catalog is an authoritative resource for organizations to support improvement of their patch management best practices.
  • CISA’s Multifactor Authentication webpage provides best practices for network defenders to mitigate threats to accounts and systems that use MFA.
  • CISA’s Cyber Hygiene Services help organizations reduce the risk of a successful cyberattack.
  • USSS’s Preparing for a Cyber Incident outlines basic steps an organization can take before, during, and after a cyber incident.
  • CISA’s Cyber Security Evaluation Tool (CSET) provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture; see Downloading and Installing CSET for step-by-step guidance to help your organization evaluate cybersecurity practices on your networks.
  • CISA’s Ransomware Risk Assessment helps assess an organization’s ability to counteract a ransomware infection.
  • Department of Health and Human Services’ Cybersecurity Performance Goals is a resource to help healthcare organizations implement high-impact cybersecurity practices.
  • CISA’s Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk and its implementation guidance 
  • CISA’s CI Fortify: Strengthening Resilience Across Critical Infrastructure
  • CISA’s Eviction Strategies Tool enables incident response teams to quickly turn observed behaviors into remediation plans
  • U.K.’s National Cyber Security Centre 
  • U.K.’s National Crime Agency 

  Reporting

  Your organization has no obligation to respond or provide information to the FBI and other authoring agencies in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI or other authoring agencies, reporting must be consistent with applicable state and federal laws.

  The FBI and other authoring agencies are interested in any information, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

  Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

  The authoring agencies do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office, a local USSS Field Office, or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center (contact@cisa.dhs.gov) or by calling 1-844-Say-CISA (1-844-729-2472).

  In the U.K., report incidents of a cybercrime or fraud at the UK’s Home for Reporting Cyber Crime & Fraud or 0300-123-2040, your local police force, or use the non-emergency number 101.

  Disclaimer

  The information in this report is being provided “as is” for informational purposes only. CISA and the FBI/USSS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, or USSS.

  The authoring agencies recognize that infrastructure used for malicious activity may be hosted on cloud or virtualized platforms where IP addresses can be dynamically or temporarily assigned. As a result, an address associated with malicious activity at one point in time may later be reassigned to benign services. Accordingly, these indicators should be interpreted as historically observed infrastructure within the activity window and should be corroborated with current network telemetry or additional intelligence sources when used for defensive or investigative purposes.

  Version History

  October 20, 2026: Initial version.

• Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

  Advisory at a Glance 

  Title	Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
  Original Publication	October 8, 2026
  Executive Summary	Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including US critical infrastructure sectors. These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts. To help mitigate against this activity, organizations should prioritize disabling unused services and ports, sanitizing web application inputs to prevent injection attacks, implementing multifactor authentication for all services, and applying timely patches to reduce risks of compromise.
  Affected Products	CVE-2014-6278  CVE-2015-3306  CVE-2015-5477  CVE-2016-3081  CVE-2019-11510  CVE-2021-22205  CVE-2021-3199  CVE-2023-22894
  Key Actions	Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols.  Sanitize user input in web applications to prevent possible cross-site scripting (XSS) payload injection.  Implement identity, credential, and access management (ICAM) policies, and then require multifactor authentication (MFA) for services (to the extent possible).
  Indicators of Compromise	For a downloadable copy of indicators of compromise, see:  AA26-281A STIX XML AA26-281A STIX JSON
  Intended Audience	Organizations: Government; Federal Civilian Executive Branch (FCEB); State, Local, Tribal, and Territorial (SLTT); Critical Infrastructure.  Sectors:Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology.  Roles: Defensive Cybersecurity Analysts, Vulnerability Analysts, Security Systems Managers, Incident Response Analysts

  Introduction 

  Integrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit US and foreign organization networks across multiple sectors using various tools and techniques. This advisory provides an analysis of tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) from Integrity Technology Group and the threat actors they enable (hereafter referred to as “the threat actors”). The analysis in this advisory provides network defenders with detection and mitigation guidance to reduce the risk of threat actors compromising critical data. 

  The threat actors use a unique combination of large-scale botnets, virtual private network (VPN) infrastructure, living-off-the-land (LOTL) techniques, and repositories of computer network exploitation (CNE) tools. Although these techniques are not unique to Chinese threat actors, this advisory details how the threat actors use them to support CNE activity. 

  The threat actors targeted victims across multiple US critical infrastructure sectors, including: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors also targeted victims in US law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America. 

  The information in this advisory originates from technical evidence recovered from, and observed during, multiple Federal Bureau of Investigation (FBI) investigations related to Integrity Technology Group. 

  The FBI, Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), United Kingdom National Cyber Security Centre (NCSC-UK), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (Cyber Centre), Japan’s National Police Agency (NPA) and National Cybersecurity Office (NCO), New Zealand’s National Cyber Security Centre (NCSC-NZ), and Spain’s Centro Nacional de Inteligencia (CNI), hereafter referred to as “the authoring organizations”—are releasing this joint cybersecurity advisory to urge network defenders from government and relevant organizations to: 

  • Hunt for potential compromises from this activity. 
  • Better protect against this threat activity and other Chinese government-linked cyber targeting. 

  This advisory also provides our US federal, state, local, territorial, and tribal (FSLTT) government agencies, and international and industry partners, with the indicators and details necessary to proactively defend their networks against this threat and protect critical data. 

  For more information on People’s Republic of China (PRC) state-sponsored malicious cyber activity in general, see the FBI’s Cyber Threat Overview: China webpage. For more information on China-linked malicious cyber activity, see CISA’s People’s Republic of China Threat Overview and Advisories webpage. 

  The authoring organizations encourage network defenders to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of these incidents. 

  Download the PDF version of this report:

  Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data (PDF, 1.41 MB )

  For a downloadable copy of IOCs, see: 

  AA26-281A STIX (JSON, 1,021.16 KB )

  AA26-281A STIX XML (XML, 658.87 KB )

  Threat Actor Background 

  Integrity Technology Group (Integrity Tech) is a China-based for-profit company with links to the Chinese government. Integrity Tech employs individuals who support malicious cyber activity in different ways, including acquiring or building cyber tools for use and sale, acquiring and hosting infrastructure, and compromising networks across global victims, which the authoring organizations track as China-based malicious cyber activity. The services provided by Integrity Tech also contribute to the larger Chinese cyber ecosystem, which aims to exfiltrate sensitive data from victims around the world.

  Notably, the threat actors enabled by Integrity Tech use TTPs consistent with the cyber activity publicly known as Flax Typhoon, Ethereal Panda, and Red Juliett, among others. However, these threat actors may also perform activity not associated with Integrity Tech. 

  Note:Cybersecurity companies have different methods of tracking and attributing cyber actors and these may not be a 1:1 correlation to the US Government's methodology and understanding for all activity related to these groupings. 

  Technical Details 

  Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 19. See Appendix A: Indicators of Compromise and the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

  Reconnaissance  

  The threat actors use a variety of open source scanning tools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: Indicators of Compromise for a complete list of scanning tools. 

  Some of these tools contain features useful for fingerprinting remote applications, testing remote authentication protocols, or enumerating the pages of a website. The use of open source tools typically found on GitHub suggests the threat actors tend to look for more vulnerable targets. In general, the threat actors focus on scanning ports 21 (file transfer protocol [FTP]), 22 (SSH), 53 (domain name system [DNS]), 80 (HTTP), 443 (HTTPS), and 1080 (SOCKS). When scanning websites with dirsearch, the threat actors attempt to enumerate PHP and ASP (.NET) pages. 

  MicroScan 

  As early as 2017, these threat actors have also used a malicious application known as “MicroScan.” This Python-based web application contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities. The threat actors used these scripts to target services including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts. See Appendix B: Observed Common Vulnerabilities and Exposuresfor a list of successfully exploited common vulnerabilities and exposures (CVEs) recovered from penetration testing scripts. Figure 1 shows a MicroScan account dashboard displaying detected vulnerabilities.

  Initial Access and Execution 

  Since at least mid-January 2021, the threat actors have gained access to victim networks and cloud-based services primarily through command line utilities built on exploit codes written in popular programming languages, such as Python and Go [T1059.006]. Additionally, the threat actors have used JavaScript [T1059.007] and HTML code to execute cross-site scripting (XSS) attacks. XSS vulnerabilities allow malicious actors to use unwitting third-party applications vulnerable to XSS to modify content on a webpage [T1189] and target other victims. 

  During the investigations, the FBI recovered an XSS payload used by the threat actors. When executed on a vulnerable website running JavaScript, this payload modifies webpage content to display username and password fields, facilitating user credential harvesting (see Figure 2).

  After a user enters any username and password, the executed XSS payload page generates a link to download a password-protected .zip file. The .zip file’s contents originate from encoded bytes within the XSS payload and contain the executable file live700_v1.exe. 

  Analysis of live700_v1.exe demonstrated the executable begins a process named DiagTrack.exe, which shares its name with legitimate Windows software [T1036.003]. DiagTrack.exe then establishes encrypted communications over the HTTP protocol with the domain dns.studiocloud.xyz, which the FBI attributes to Integrity Tech. Given that the executable also contains functions designed to query data from user mailboxes, the FBI assesses the malware likely targets user email data for exfiltration. 

  EBurst 

  The threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multiple interfaces for password spraying [T1110.003] and password guessing [T1110.001] against each supplied email address. Based on the open source EBurst ReadMe file, these interfaces include:

  • Exchange Control Panel (ECP); 
  • Exchange Web Services (EWS); 
  • Offline Address Book (OAB); 
  • Outlook Web Access (OWA); 
  • Remote Procedure Call (RPC); 
  • Application Programming Interface (API); 
  • Messaging Application Programming Interface (MAPI); 
  • PowerShell; 
  • Autodiscover; and  
  • Microsoft-Server-ActiveSync. 

  Network defenders should include these interfaces when defending against EBurst. 

  Persistence 

  To establish persistence, the threat actors install virtual private network (VPN) software clients on victim devices [T1133] to obfuscate command and control (C2) communications or other actions, further preventing victims from attributing malicious network activity. 

  The threat actors typically download SoftEther installers onto victim devices from threat actor-controlled infrastructure using PowerShell or LOTL binaries for Windows Systems [T1059.001]. For Linux/Unix distributions, the threat actors download SoftEther installers via curl or wget. For either operating system, the actors configure the SoftEther client to automatically reconnect on startup. They often name the installers conhost.exe or dllhost.exe to appear as common Windows executables [T1036.003]. Additionally, endpoint detection software is less likely to flag SoftEther because it is a legitimate VPN software. 

  In some observed cases, the threat actors stored the SoftEther program directly on the server. Analysis of these servers revealed victim domains and subdomains that hosted the SoftEther connections: 

  • 98aiblog[.]com; 
  • hmbcloud[.]com; 
  • hmbcloud[.]net; 
  • hmbiplc-01[.]com; 
  • iepl.node[.]cm;  
  • javacheck.ooguy[.]com; 
  • javaupdate.giize[.]com; 
  • sexytube0[.]com; and 
  • twimg.co[.]uk. 

  The threat actors use SoftEther to maintain persistent remote access to victim devices to enable data exfiltration. The FBI observed the threat actors installing the client on the end-user’s system, which connected to the C2 server using one of the identified domains, subdomains, or the server’s IP address. The threat actors also accessed other targets, including cybersecurity websites, connected to these hubs. 

  Collection and Exfiltration 

  The FBI observed the threat actors downloading databases or manually pulling data from the victim emails and staging the exfiltration data with discreet file names to minimize detection of the MySQL email dump. Some of these names include: 

  • 001.gif; 
  • All_scanner_vXX.pl.gz (XX represents either a one- or two-digit number); 
  • Css.js; 
  • Include.png; 
  • M2k.js; 
  • M2k_list.js; and 
  • M2k_ui_adm.js. 

  Curlc4.txt 

  The FBI observed that the threat actors created a bot using the PHP script Curlc4.txt to obtain emails from victims. The script is specifically designed to interface with the Microsoft EWS API, which allows the threat actors to access email and content items, such as calendars and contacts [T1114.002]. 

  Based on observations, the script appears to be stand-alone rather than installed on a compromised device. The script uploaded emails to a remote server [T1020], obfuscating many of the directories and files it created, and changed the name of the child process to crypto. 

  The script downloaded the original file from https://upl.natcloudservice[.]com using IP address 149.28.132[.]137. The main C2 domain for the bot was natcloudservice[.]com, and the domain communicated with https://natcloudservice[.]com/ews and upl.natcloudservice[.]com/ews. Before exfiltration, the bot compressed emails. In some instances, the threat actor also used a password to encrypt emails using RC4 or AES-128-CBC [T1560.003]. 

  The PHP script took up to two command-line arguments. The first argument appeared to be the root directory where the scripts execute. If the first argument was not supplied, then the script searched for a writeable directory [T1074.001] to use as its directory. The script searched the directories listed in Table 1 until it found a writeable one. The script stored the second command-line argument in a variable saved to the targeted system.

  Table 1. Directories Searched byCurlc4 

  Directory to Search	Subdirectories to Skip
  /	/bin, /boot, /dev, /etc, /run, /proc, /sys, /var, /tmp, /usr
  /home
  /var/www
  /usr
  /var/tmp

  The following is a list of unique strings found in the script:

  • $dir/storage/fm/.run; 
  • $dir/.run; 
  • public $password='jh4jnryw76ikmh'; 
  • public $file='/var/tmp/.sess.zip';
  • https://upl.natcloudservice[.]com.ews; 
  • public $key='rhnr5m54pk65wertc'; 
  • $this->enc="r";this->cipher="rc4";this->iv=""; 
  • $this->enc="a";this->cipher="aes-128-cbc";this->iv="1111111111111111"; 
  • https://natcloudservice[.]com/ews; and 
  • curl_setopt($this->ch, CURLOPT_HTTPHEADER,array("X-Id: $clientid")). 

  Other directories and files that indicate this script may be executed on a system include: 

  • RUNNING_DIRECTORY/storage/fm; 
  • RUNNING_DIRECTORY /storage/fm.run (file); 
  • RUNNING_DIRECTORY /.run; 
  • RUNNING_DIRECTORY/clientid (file); and 
  • RUNNING_DIRECTORY/cp (file). 

  DC.exe

  The threat actors used DC.exe to execute the DCSync replication technique [T1003.006] to copy sensitive information from the Active Directory (AD), including account credentials, group membership details, and trust relationships. DC.exe used a Remote Procedure Call (RPC) binding to the victim’s domain controller. The file then used the Directory Replication Service to retrieve data from the victim’s AD. Specifically, it retrieved a handle to the local security policy object, which is used to query the domain controller for the DNS domain name, domain security identifier (SID), and domain replication epoch. The file also used the following object IDs to retrieve information about Active Directory attributes and configurations: 

  • 1.2.840.113556.1.2.48; 
  • 1.2.840.113556.1.4.1; 
  • 1.2.840.113556.1.4.125; 
  • 1.2.840.113556.1.4.129; 
  • 1.2.840.113556.1.4.133; 
  • 1.2.840.113556.1.4.135; 
  • 1.2.840.113556.1.4.146; 
  • 1.2.840.113556.1.4.159; 
  • 1.2.840.113556.1.4.160; 
  • 1.2.840.113556.1.4.221; 
  • 1.2.840.113556.1.4.27; 
  • 1.2.840.113556.1.4.302; 
  • 1.2.840.113556.1.4.55; 
  • 1.2.840.113556.1.4.609; 
  • 1.2.840.113556.1.4.656; 
  • 1.2.840.113556.1.4.8; 
  • 1.2.840.113556.1.4.90; 
  • 1.2.840.113556.1.4.94; and 
  • 1.2.840.113556.1.4.96. 

  Data Exfiltration 

  The FBI recovered an archived email database the threat actors used to target email accounts of victim organizations. The threat actors collect account credentials and exfiltrate victim email data from on-premise systems and cloud-based services. Observed victims of email data theft included government organizations, law enforcement agencies, healthcare systems, and religious institutions located in Southeast Asia. In some instances, the threat actors restricted access to the exfiltrated data to only IP addresses from Xiamen, China. 

  Office-cli Program

  The threat actors use a command-line utility office-cli [T1059.004] to continuously target and access Microsoft Outlook 365 email accounts to exfiltrate emails across different time periods. The threat actors occasionally update these accounts and swap them for the most recent accounts. The threat actors use office-cli to automate access and exfiltration of mail content using configuration files, such as client_id, tenant_id, and secret.

  The FBI observed the threat actors executing office-cli from the command line or by running it from a Bash script. In both instances, the threat actors place the JSON files required to access the mailboxes in the config directory. Additionally, office-cli saves data gathered from the victims in a subdirectory of the dump directory. The threat actors evade detection when using this program by using legitimate access methods.

  The threat actors maintain a custom web application that provides third-party access to stolen email content. Users of this application can pass specific arguments in URLs to see email content for specific accounts.

  Indicators of Compromise

  See Appendix A: Indicators of Compromise for a list of all observed indicators.

  MITRE ATT&CK Tactics and Techniques

  See Table 2 to Table 9 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

  Table 2. Reconnaissance 

  Technique Title	ID	Use
  Active Scanning: Vulnerability Scanning	T1595.002	The threat actors leverage several scanning tools to find vulnerabilities in networks and web-based applications.

  Table 3. Initial Access 

  Technique Title	ID	Use
  Drive-by Compromise	T1189	The threat actors execute XSS attacks to leverage an unwitting third-party application to modify content on a webpage.

  Table 4. Execution 

  Technique Title	ID	Use
  Command and Scripting Interpreter: PowerShell	T1059.001	The threat actors typically download SoftEther installers onto victim devices from threat actor controlled infrastructure using PowerShell.
  Command and Scripting Interpreter: Unix Shell	T1059.004	The threat actors use office-cli, a Linux-based binary, to continuously target and access Microsoft Outlook 365 accounts. Office-cli automates exfiltration of mail content using configuration files, including account credentials.
  Command and Scripting Interpreter: Python	T1059.006	The threat actors gain access to victim networks and cloud-based services primary through command-line utility tools based on exploit codes written in Python.
  Command and Scripting Interpreter: JavaScript	T1059.007	The threat actors use JavaScript to execute XSS attacks.

  Table 5. Persistence 

  Technique Title	ID	Use
  External Remote Services	T1133	The threat actors install VPN software clients on victim devices to establish persistence and obfuscate C2 communications.

  Table 6. Defense Evasion 

  Technique Title	ID	Use
  Masquerading: Rename Legitimate Utilities	T1036.003	The threat actors run executables with the same name of a known, legitimate Windows software and installers to evade detection.

  Table 7. Credential Access 

  Technique Title	ID	Use
  OS Credential Dumping: DCSync	T1003.006	The threat actors use DC.exe to execute the DCSync replication technique to copy sensitive information from the Active Directory.
  Brute Force: Password Guessing	T1110.001	The threat actors use eburst.py to conduct password guessing to compromise email accounts on Microsoft Exchange servers.
  Brute Force: Password Spraying	T1110.003	The threat actors use eburst.py to conduct password spraying to compromise email accounts on Microsoft Exchange servers.

  Table 8. Collection 

  Technique Title	ID	Use
  Email Collection: Remote Email	T1114.002	The threat actors use the PHP script to interface with the Microsoft EWS API, enabling them to access email and content items.
  Archive Collection Data: Archive via Custom Method	T1560.003	The threat actors use a custom bot to compress, and in some cases encrypt, files prior to exfiltration.
  Data Staged: Local Data Staging	T1074.001	The PHP script searches for a writeable directory to use as its directory.

  Table 9. Exfiltration 

  Technique Title	ID	Use
  Automated Exfiltration	T1020	The threat actors leverage the PHP script to automatically upload emails to a remote server.

  Incident Response

  If a potential compromise is detected, organizations should take the following actions: 

  1. Determine which hosts were compromised and isolate them by quarantining or taking them offline.  
  2. Initiate threat hunting activities to scope the intrusion.  
     1. Collect and review relevant artifacts, logs, and other data to identify threat actor TTPs, compromised devices and accounts, a timeline of activity, etc.  
  3. Follow national guidelines and requirements in your country on reporting cyber incidents(see Contact Information). 
  4. Apply eviction countermeasures to contain the incident and eradicate the threat actor from the network.
     1. Start applying countermeasures after collecting enough threat hunting data to inform effective countermeasure selection; this will likely overlap with threat hunting activities): 
     2. Use CISA’s Eviction Strategies Tool to assemble countermeasures for a systematic eviction plan—the tool comprises Playbook-NG (a web application) and COUN7ER (a database of post-compromise countermeasures mapped to adversary TTPs).  
        1. Use Playbook-NG and COUN7ER together to assemble a systematic eviction plan, or playbook, that leverages distinct countermeasures to contain and evict cyber threat actors.  
        2. The playbook features a list of recommended response actions based on threat actor TTPs and includes each action’s intended outcome, preparatory steps, and associated risks. For more information, see CISA’s Eviction Strategies Tool Fact Sheet. 
  5. Harden the network to prevent additional malicious activity (see Mitigations for guidance). 

  Mitigations

  The authoring organizations recommend network defenders and organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections. 

  The authoring organizations recommend network defenders and organizations implement these mitigations:

  • Disable unused services and ports, such as automatic configuration, remote access, or file sharing protocols. 
    • Configure applications to reveal as little information as possible when serving login pages or banner information in response to external requests. 
    • Consider using an attack surface management service or web-based search platforms that search the internet to identify exposed services or ports [CPG 3.S]. For additional support, follow CISA’s Internet Exposure Reduction Guidance and NSA’s Attack Surface Management. 
  • Sanitize user input in web applications to prevent possible XSS payload injection. 
  • Implement identity, credential, and access management (ICAM) policies across the organization and then require multifactor authentication (MFA)[CPG 3.F] for all services (to the extent possible), particularly for webmail, VPNs, and accounts that access critical systems. 
  • Replace default passwords with strong passwords [CPG 3.A]. 
    • Limit and audit user accounts with administrative privileges and configure access controls with least privilege in mind.  
    • Ensure only users that need administrator privileges are granted these privileges, and regularly review access to assess whether it is still required [CPG 3.G]. 
  • Enable download and domain reputation screening in web browsers, along with protective DNS resolution, to block downloads of known malware and connections to websites and domains with unsafe reputations. 
  • Monitor for signs of unauthorized use of LOTL tools and unexpected Active Directory replication [CPG 4.B]. 
  • Implement network segmentation to ensure a compromised device has no access to sensitive resources of another organizational unit [CPG 3.I]. 
    • Use the principle of least privilege to provide just enough connectivity for devices to perform their intended functions [CPG 3.H]. 
    • For a less resource constrictive mitigation, organizations may segment edge devices internally. 
  • Monitor cloud accounts for connected applications that can access sensitive data in file systems and email data. 
  • Review web application access logs for signs of exploitation attempts, such as malicious directory traversal attempts, command injection attempts, or enumeration attempts [CPG 3.Q]. 
  • Apply patches and updates, including software and firmware updates (regular patching mitigates many high-risk security vulnerabilities) [CPG 2.B]. 
    • If available, use automatic update channels from trusted network locations. 
    • Do not trust email messages claiming to provide software updates as attachments or via links to untrusted websites. 
  • Install and regularly update antivirus softwareon all hosts and enable real time detection. 
  • Monitor for abnormal and high volumes of unexpected traffic(scanning) using firewalls and/or intrusion detection systems [CPG 4.B]. 
    • Since an attempted compromise using a distributed denial of service (DDoS) technique may appear as normal traffic, it is critical for organizations to define, monitor, and prepare for abnormal traffic volumes. 
  • Monitor for high volumes of outbound or upload traffic from workstations or other devices that usually have low volumes of uploads compared to downloads. 
  • Monitor logs and investigate unusual IP addresses and ports in command lines, registry entries, and firewall logs to identify other hosts that are potentially involved in actor actions [CPG 3.Q]. 
    • Review perimeter firewall configurations for unauthorized changes and/or entries that may permit external connections to internal hosts. 
  • Monitor for abnormal account activity, such as logons outside of normal working hours and impossible time and distance logons (e.g., a user logging on from two geographically separated locations at the same time) [CPG 4.B]. 
  • Implement a recovery plan to maintain and retain multiple copiesof sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, or the cloud) [CPG 1.C]. 
  • Regularly back up data and password protect backup copies offline [CPG 3.O]. 
    • Ensure copies of critical data are not accessible for modification or deletion from the system where data resides. 
  • Replace end-of-life products with supported alternatives that are included in vendor support plans. 
  • Ensure systems use the strongest feasible form of authentication[CPG 3.B; CPG 3.F]. 
  • Harden authentication protocols and access lists [CPG 3.H]. 
    • Regularly rotate keys for your service accounts, use strong key lengths to enhance security and minimize the risk of key compromise, and implement role-based access control (RBAC) to avoid granting excess privileges. 
  • Provide cyber security awareness and training [CPG 3.J]. 
    • Regularly train users on information security principles and techniques, as well as overall emerging cybersecurity risks and vulnerabilities (e.g., ransomware and phishing scams). 
  • Regularly engage reputable and skilled penetration testing services to evaluate your public attack surface and remediate the most commonly exploited vulnerabilities used by these actors. 

  Validate Security Controls 

  In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory. 

  To get started: 

  1. Select an ATT&CK technique described in this advisory (see Table 2toTable 9). 
  2. Align your security technologies against the technique. 
  3. Test your technologies against the technique. 
  4. Analyze your detection and prevention technologies’ performance. 
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data. 
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process. 

  The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

  Resources 

  • For more information on attack surface management, see: 
    • CISA’s Internet Exposure Reduction Guidance; 
    • CISA’s Cyber Hygiene Services for US critical infrastructure; and 
    • NSA’s Attack Surface Management for the US Defense Industrial Base (DIB).
  • For additional information on the UK’s National Cyber Security Centre’s (NCSC-UK’s) resources see: 
    • Network Security Fundamentals; 
    • Protective DNS Service; 
    • Guidance Selecting Right Methods to Authenticate Customers; 
    • Guidance Ransomware-Resistant Backups; and 
    • Penetration testing guidance, see Penetration Testing. 
  • For more information on sanitizing user input, see: 
    • CISA’s Secure by Design Alert: Eliminating Cross Site Scripting Vulnerabilities;
    • The Open Worldwide Application Security Project’s (OWASP) Input Validation Cheat Sheet; and 
    • OWASP’s Cross-Site Scripting Prevention Cheat Sheet. 
  • For more information on protective DNS (PDNS), see: 
    • NSA and CISA’s guidance Selecting a Protective DNS Service; and  
    • NSA’s Protective DNS Service offerings for the US Defense Industrial Base.  
  • For more information on LOTL, see ASD’s ACSC and CISA’s joint guidance Identifying and Mitigating Living Off the Land Techniques. 
  • For more information on defending Active Directory, see ASD’s ACSC’s joint guidance Detecting and Mitigating Active Directory Compromises. 
  • For more information on Canadian Cyber Centre resources, see: 
    • Phishing-resistant MFA; 
    • Top 10 security actions on network segmentation; 
    • Top 10 security actions for patching OS and applications; 
    • Obsolete products (end-of-life); 
    • Preventative security tools; and 
    • Best practices with passphrases and passwords. 

  Contact Information  

  US organizations are encouraged to report suspicious or criminal activity related to information in this advisory to the FBI, CISA, and/or NSA: 

  • File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office, or contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding the incident: 
    • Date, time, and location of the incident; 
    • Type of activity; 
    • Number of people affected; 
    • Type of equipment used for the activity; and 
    • Name of the submitting company or organization, and a designated point of contact. 
  • For NSA cybersecurity guidance inquiries, contact CybersecurityReports@nsa.gov. 

  United Kingdom organizations:Report a significant cyber security incident at ncsc.gov.uk/report-an-incident (monitored 24 hours) or, for urgent assistance, call 03000 200 973. 

  Australian organizations: Visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.

  Canadian organizations: Report incidents by emailing the Canadian Centre for Cyber Security (Cyber Centre) at contact@cyber.gc.ca, (613) 949-7048, or 1-833-CYBER-88. 

  Japan organizations: Report an incident to the National Cybersecurity Office (NCO) via email at first-team@cyber.go.jp or the National Police Agency’s (NPAs) web portal at https://www.npa.go.jp/bureau/cyber/soudan.html. 

  New Zealand organizations:Visit ncsc.govt.nz or call 0800 114 115 to report cyber security incidents. 

  Disclaimer 

  The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring organizations. 

  Version History 

  October 8, 2026: Initial version. 

  Appendix A: Indicators of Compromise

  See Table 10 to Table 15 for a list of observed IOCs. The IOCs listed in the appendices may or may not be addressed in detail in the body of this document; however, endpoint detection systems can ingest all of these IOCs to help mitigate threat activity. 

  Disclaimer: Several of the observed IOCs date back to as early as 2016. The authoring organizations recommend investigating or vetting these IOCs prior to taking action, such as blocking. 

  Note: The first and last dates are included in this table, with an asterisk (*) denoting the WHOIS registry expiration date specified within. 

  Table 10. Domain Names 

  Domain	First Seen	Last Seen
  _msdcs.cktime.ooguy[.]com	12/26/2023	7/30/2024
  067[.]cz	12/6/2018	1/16/2021
  1421.client.96html[.]com	1/18/2019	1/18/2027*
  1421.cloud.96html[.]com	1/18/2019	1/18/2027*
  1421.support.96html[.]com	1/18/2019	1/18/2027*
  154-119-131-252-103-58-216-162-36.m.secshow[.]net	6/26/2023	6/26/2026*
  20656.hus1.ptps[.]tk	12/5/2019	7/24/2021
  20656.hus3.ptps[.]tk	12/5/2019	7/24/2021
  2-12-44-140-78-81-211-109-241.h.secshow[.]net	6/26/2023	6/26/2026*
  22852.careers.96html[.]com	1/18/2019	1/18/2027*
  22852.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  22852.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  23175.careers.96html[.]com	1/18/2019	1/18/2027*
  23175.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  24280.hus1.ptps[.]tk	12/5/2019	7/24/2021
  2637596418.softether[.]net	9/22/2023	6/22/2024
  28394.careers.96html[.]com	1/18/2019	1/18/2027*
  28394.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  28394.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  28733.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  28733.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  30773.hus2.ptps[.]tk	12/5/2019	7/24/2021
  30773.hus3.ptps[.]tk	12/5/2019	7/24/2021
  35584.careers.96html[.]com	1/18/2019	1/18/2027*
  35584.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  35584.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  39583.b.alitagotest[.]cf	1/27/2020	12/7/2021
  3w.feeee[.]io	2/8/2024	2/8/2025
  44673.careers.96html[.]com	1/18/2019	1/18/2027*
  44673.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  47298.96html[.]com	1/18/2019	1/18/2027*
  47298.client.96html[.]com	1/18/2019	1/18/2027*
  47298.cloud.96html[.]com	1/18/2019	1/18/2027*
  47298.support.96html[.]com	1/18/2019	1/18/2027*
  50669.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  51640.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  51943.hus1.ptps[.]tk	12/5/2019	7/24/2021
  51943.hus3.ptps[.]tk	12/5/2019	7/24/2021
  54-2-32-236-208-2-40-107-38.h.secshow[.]net	6/26/2023	6/26/2026*
  60928.hus1.ptps[.]tk	12/5/2019	7/24/2021
  66-37-178-96-110-2-40-107-38.h.secshow[.]net	6/26/2023	6/26/2026*
  74788.careers.96html[.]com	1/18/2019	1/18/2027*
  74788.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  77692.careers.96html[.]com	1/18/2019	1/18/2027*
  77692.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  77692.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  82262.careers.96html[.]com	1/18/2019	1/18/2027*
  82262.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  85005.careers.96html[.]com	1/18/2019	1/18/2027*
  85005.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  85005.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  88783.hus1.ptps[.]tk	12/5/2019	7/24/2021
  90174.careers.96html[.]com	1/18/2019	1/18/2027*
  90174.careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  96976.careers.96html[.]com	1/18/2019	1/18/2027*
  96976.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  96cee[.]com	1/7/2016	5/9/2024
  96html[.]com	1/18/2019	9/3/2024
  98aiblog[.]com	3/11/2024	3/12/2026*
  a.alitagotest[.]cf	1/27/2020	12/7/2021
  a.studiocloud[.]xyz	12/31/2021	12/3/2024
  admin.dellme[.]ml	3/20/2020	8/8/2020
  alitagotest[.]cf	1/27/2020	12/7/2021
  arforcex[.]com	3/5/2019	5/11/2021
  asean.twimg.co[.]uk	9/21/2024	12/15/2024
  az.studiocloud[.]xyz	12/31/2021	12/3/2024
  b.alitagotest[.]cf	1/27/2020	12/7/2021
  bailbonding[.]info	1/3/2020	1/3/2022
  bbs.sunmoon[.]website	9/20/2023	9/20/2024
  bj-hk.hmbcloud[.]net	3/29/2021	3/29/2021
  bj-jp.hmbcloud[.]net	4/10/2021	5/7/2021
  blog.98aiblog[.]com	7/12/2024	8/14/2024
  bsnl.twimg.co[.]uk	6/17/2024	7/7/2024
  careers.96html[.]com	1/18/2019	1/18/2027*
  careers.trendmicro.96html[.]com	1/18/2019	1/18/2027*
  cch.ooguy[.]com	10/11/2024	10/11/2024
  check.96html[.]com	1/18/2019	1/18/2027*
  checkapi[.]tk	1/6/2022	4/10/2023
  checkinfo[.]tk	9/22/2012	12/14/2022
  chr0mail[.]com	6/23/2021	6/23/2026*
  cktime.ooguy[.]com	12/26/2023	7/30/2024
  client.96html[.]com	1/18/2019	1/18/2027*
  cloud.96html[.]com	1/18/2019	1/18/2027*
  csrfproxy.studiocloud[.]xyz	12/31/2021	12/3/2024
  dasxcyb[.]ga	1/29/2021	1/29/2021
  dc-29465b27aa45.96html[.]com	1/18/2019	1/18/2027*
  dc-4fe9871cb224.96html[.]com	1/18/2019	1/18/2027*
  dc-582fc0f46da9.96html[.]com	1/18/2019	1/18/2027*
  dc-843d98722400.96html[.]com	1/18/2019	1/18/2027*
  dc-bb503834b7dc.96html[.]com	1/18/2019	1/18/2027*
  dc-c11a983d7f83.96html[.]com	1/18/2019	1/18/2027*
  dellme[.]ml	3/20/2020	8/8/2020
  dns.studiocloud[.]xyz	12/10/2021	5/9/2024
  dns361[.]tk	2/7/2022	11/19/2023
  dsdsei[.]com	4/10/2018	4/10/2025
  eck.giize[.]com	9/28/2024	9/30/2024
  eg.twimg.co[.]uk	9/22/2024	12/14/2024
  etechhosting.twimg.co[.]uk	9/21/2024	12/16/2024
  fcchk.twimg.co[.]uk	9/21/2024	12/14/2024
  feeee[.]io	2/8/2024	2/8/2025
  findfindx[.]com	1/6/2022	8/10/2023
  fukua[.]org	11/24/2017	11/24/2027*
  gate.sinica.edu.tw.checkapi[.]cf	1/6/2022	4/10/2023
  googles.ddns[.]net	10/22/2021	10/22/2021
  gz-hk.hmbcloud[.]net	12/28/2020	1/22/2021
  h.secshow[.]net	6/26/2023	6/26/2026*
  h5.feeee[.]io	2/8/2024	2/8/2025
  halloween.checkapi[.]cf	1/6/2022	4/10/2023
  helpuself.ptps[.]tk	12/5/2019	7/24/2021
  hgiga.96html[.]com	1/18/2019	1/18/2027*
  honey1314520[.]com	11/23/2020	11/23/2022
  hook.studiocloud[.]xyz	12/31/2021	12/3/2024
  hus1.ptps[.]tk	12/5/2019	7/24/2021
  hus3.ptps[.]tk	12/5/2019	7/24/2021
  hw1.ptps[.]tk	12/5/2019	7/24/2021
  ica.96html[.]com	1/18/2019	1/18/2027*
  im.arforcex[.]com	3/4/2019	3/5/2026*
  imap.sunmoon[.]website	9/20/2023	9/20/2024
  info.96html[.]com	1/18/2019	1/18/2027*
  integritytoch[.]com	12/11/2020	12/11/2022
  iplc-hk.hmbcloud[.]com	11/30/2020	12/8/2020
  javacheck.ooguy[.]com	12/22/2023	6/25/2024
  javaupdate.giize[.]com	12/22/2023	6/15/2024
  just.checkapi[.]cf	1/6/2022	4/10/2023
  kk.dasxcyb[.]ga	1/29/2021	1/29/2021
  leicc009[.]ga	5/24/2020	4/24/2021
  live.studiocloud[.]xyz	12/31/2021	12/3/2024
  ls.twimg.co[.]uk	9/21/2024	12/14/2024
  m.secshow[.]net	6/26/2023	6/26/2026*
  ma.studiocloud[.]xyz	12/31/2021	12/3/2024
  mail.bailbonding[.]info	1/3/2020	1/3/2022
  mail.sunmoon[.]website	9/20/2023	9/20/2024
  masaplus[.]club	7/22/2021	7/22/2024
  microscan[.]me	12/10/2017	12/10/2018
  mitt.96html[.]com	1/18/2019	1/18/2027*
  ms.studiocloud[.]xyz	12/31/2021	12/3/2024
  msedge[.]store	11/9/2023	11/9/2025
  mx.sunmoon[.]website	9/20/2023	9/20/2024
  natcloudservice[.]com	9/8/2023	9/8/2024
  nikoes[.]gq	6/15/2021	3/22/2023
  np.twimg.co[.]uk	9/21/2024	11/25/2024
  ns1.alitagotest[.]cf	1/27/2020	12/7/2021
  ns1.honey1314520[.]com	11/23/2020	11/23/2022
  ns1.nikoes[.]gq	6/15/2021	3/22/2023
  ns2.nikoes[.]gq	6/15/2021	3/22/2023
  one.hmbiplc-01[.]com	4/2/2022	4/2/2022
  payment.feeee[.]io	2/8/2024	2/8/2025
  pdc._msdcs.cktime.ooguy[.]com	12/26/2023	7/30/2024
  ptps[.]tk	12/5/2019	7/24/2021
  puc.checkapi[.]tk	1/6/2022	4/10/2023
  purple76[.]com	11/11/2021	11/11/2026*
  pw.sexytube0[.]com	8/6/2021	4/18/2024
  pw2.sexytube0[.]com	10/7/2017	10/8/2027*
  random.cktime.ooguy[.]com	12/26/2023	7/30/2024
  s3crts.softether[.]net	3/25/2021	7/27/2022
  scallpay[.]com	7/3/2023	7/3/2024
  search.96html[.]com	1/18/2019	1/18/2027*
  secretr.feeee[.]io	2/8/2024	2/8/2025
  secshow[.]net	6/26/2023	6/26/2026*
  senate.twimg.co[.]uk	9/21/2024	12/14/2024
  server.feeee[.]io	2/8/2024	2/8/2025
  sexytube0[.]com	10/7/2017	10/8/2027*
  shifuj[.]com	6/3/2019	6/5/2019
  sh-jp.hmbcloud[.]net	4/10/2021	4/25/2021
  shop.96html[.]com	1/18/2019	1/18/2027*
  shopify.feeee[.]io	2/8/2024	2/8/2025
  smtp.sunmoon[.]website	9/20/2023	9/20/2024
  streescans[.]com	5/10/2022	3/4/2025
  studiocloud[.]xyz	12/10/2021	5/9/2024
  sunmoon[.]website	9/20/2023	9/20/2024
  supper.feeee[.]io	2/8/2024	2/8/2025
  support.96html[.]com	1/18/2019	1/18/2027*
  szxcm-hkg01.iepl.node[.]cm	12/7/2020	1/8/2021
  t.checkinfo[.]tk	9/22/2012	12/14/2022
  teyan.microscan[.]me	12/10/2017	12/10/2018
  tj.twimg.co[.]uk	9/21/2024	12/14/2024
  traffic.96html[.]com	1/18/2019	1/18/2027*
  trendmicro.96html[.]com	1/18/2019	1/18/2027*
  trust[.]feeee	2/8/2024	2/8/2025
  tsedws[.]com	6/1/2020	6/1/2026*
  txt.studiocloud[.]xyz	12/31/2021	12/3/2024
  update.96html[.]com	1/18/2019	1/18/2027*
  upgrate.checkapi[.]cf	1/6/2022	4/10/2023
  upl.natcloudservice[.]com	9/8/2023	9/8/2024
  v3.streescans[.]com	5/10/2022	3/4/2025
  vnpt.sexytube0[.]com	10/7/2017	10/8/2027*
  vpn21.arforcex[.]com	3/4/2019	3/5/2026*
  vpn328433596.softether[.]net	3/28/2023	10/17/2024
  vpn614174689.softether[.]net	9/2/2023	9/2/2023
  vpn677190427.softether[.]net	4/17/2024	4/30/2024
  vpn718535264.softether[.]net	3/11/2022	3/11/2022
  vpn823494147.softether[.]net	6/26/2023	6/26/2023
  wanfang.accesscam[.]org	9/18/2024	9/26/2024
  webdisk.bailbonding[.]info	1/3/2020	1/3/2022
  webmail.studiocloud[.]xyz	12/31/2021	12/3/2024
  well.96html[.]com	1/18/2019	1/18/2027*
  ws.studiocloud[.]xyz	12/31/2021	12/3/2024
  wss.studiocloud[.]xyz	12/31/2021	12/3/2024
  www.96html[.]com	1/18/2019	1/18/2027*
  www.alitagotest[.]cf	1/27/2020	12/7/2021
  www.chr0mail[.]com	6/23/2021	6/23/2026*
  www.cktime.ooguy[.]com	12/26/2023	7/30/2024
  www.dns361[.]tk	2/7/2022	11/19/2023
  www.feeee[.]io	2/8/2024	2/8/2025
  www.javacheck.ooguy[.]com	6/17/2024	7/25/2024
  www.leicc009[.]ga	5/24/2020	4/24/2021
  www.msedge[.]store	11/9/2023	11/9/2025
  www.mx.sunmoon[.]website	9/20/2023	9/20/2024
  www.purple76[.]com	11/11/2021	11/11/2026*
  www.smtp.sunmoon[.]website	9/20/2023	9/20/2024
  www.sofeter[.]ml	3/13/2023	3/13/2023
  www.studiocloud[.]xyz	12/31/2021	12/3/2024
  www.sunmoon[.]website	9/20/2023	9/20/2024
  www.www.smtp.sunmoon[.]website	9/20/2023	9/20/2024
  www.www.sunmoon[.]website	9/20/2023	9/20/2024
  xassxxdns.alitagotest[.]cf	1/27/2020	12/7/2021
  ximmd.sexytube0[.]com	7/14/2020	10/31/2020
  zerogravity1986.softether[.]net	12/9/2023	12/9/2023

   

  Table 11. IP Addresses 

  IP Address	First Seen	Last Seen
  1.34.140[.]5	3/15/2023	3/20/2023
  2.58.242[.]74	12/2/2024	12/2/2024
  5.188.34[.]134	8/30/2024	9/12/2024
  5.188.230[.]69	8/7/2023	4/19/2024
  8.219.119[.]5	9/12/2024	9/12/2024
  14.1.98[.]160	3/22/2024	4/28/2024
  14.128.33[.]8	12/4/2023	1/9/2024
  14.1.98[.]223	6/20/2023	10/9/2023
  27.154.215[.]126	7/11/2023	7/11/2023
  27.154.105[.]36	2/3/2024	2/3/2024
  27.149.115[.]78	3/22/2023	3/22/2023
  27.149.79[.]35	3/23/2023	3/23/2023
  31.232.221[.]35	5/14/2024	5/17/2024
  36.112.10[.]102	9/4/2023	9/12/2024
  36.112.188[.]119	8/13/2023	8/13/2023
  36.112.186[.]135	8/14/2023	8/14/2023
  36.112.206[.]121	8/12/2023	8/13/2023
  36.249.156[.]117	11/29/2023	11/29/2023
  36.249.156[.]122	11/15/2023	11/18/2023
  36.249.156[.]159	5/31/2023	6/5/2023
  36.249.156[.]178	5/22/2023	12/6/2023
  36.249.156[.]205	11/13/2023	11/13/2023
  36.249.156[.]206	11/23/2023	11/24/2023
  36.249.156[.]220	6/7/2022	6/7/2022
  36.249.156[.]226	5/8/2023	5/13/2023
  36.112.200[.]35	8/9/2023	8/10/2023
  36.249.156[.]51	11/20/2023	11/22/2023
  36.112.198[.]68	8/13/2023	8/13/2023
  36.249.156[.]69	5/31/2023	5/31/2023
  36.112.10[.]99	9/19/2024	9/19/2024
  39.72.220[.]221	3/20/2023	3/20/2023
  42.73.98[.]232	5/13/2024	5/13/2024
  45.123.189[.]19	11/16/2021	2/14/2022
  45.32.140[.]182	1/8/2021	1/8/2021
  45.32.232[.]146	12/18/2020	12/25/2020
  45.63.123[.]142	6/4/2021	7/25/2024
  45.63.116[.]190	11/20/2019	11/20/2019
  45.131.69[.]197	3/31/2023	3/31/2023
  45.76.169[.]12	5/11/2020	5/13/2020
  45.77.195[.]169	6/12/2020	6/16/2020
  45.32.61[.]246	11/11/2024	12/16/2024
  45.77.231[.]209	1/25/2024	6/5/2024
  45.76.37[.]168	12/20/2019	12/20/2019
  45.63.59[.]121	3/19/2020	3/19/2020
  45.77.11[.]47	9/29/2020	9/29/2020
  45.32.84[.]223	4/23/2020	5/9/2020
  45.63.62[.]217	10/28/2020	11/4/2020
  45.63.48[.]36	1/10/2020	1/10/2020
  45.76.43[.]37	2/17/2020	2/27/2020
  45.76.66[.]19	4/16/2024	5/6/2024
  45.76.243[.]67	7/1/2020	7/9/2020
  45.63.17[.]9	5/9/2024	6/19/2024
  45.77.28[.]77	12/5/2021	4/3/2023
  45.76.194[.]89	11/22/2021	9/25/2023
  45.76.37[.]85	2/10/2020	2/10/2020
  45.63.95[.]62	4/10/2020	4/13/2020
  45.63.94[.]71	9/30/2019	12/16/2024
  45.77.86[.]70	12/21/2019	12/23/2019
  49.93.136[.]14	3/25/2024	3/25/2024
  49.93.184[.]194	3/25/2024	3/25/2024
  59.120.144[.]153	5/24/2023	5/25/2023
  59.124.120[.]178	2/20/2023	9/27/2023
  59.120.167[.]25	1/15/2024	1/15/2024
  59.125.128[.]54	3/30/2023	10/7/2023
  59.120.58[.]176	3/8/2022	3/8/2022
  60.250.199[.]112	11/15/2022	12/1/2022
  60.250.146[.]19	11/17/2022	12/18/2023
  60.251.155[.]19	1/4/2023	9/23/2023
  60.248.152[.]204	5/11/2023	5/16/2023
  59.120.82[.]67	11/22/2023	1/8/2024
  60.184.242[.]224	3/23/2023	3/23/2023
  60.251.205[.]37	12/20/2021	12/23/2021
  60.220.43[.]193	10/3/2023	10/3/2023
  60.251.58[.]145	6/8/2023	1/22/2024
  60.248.1[.]64	12/8/2022	4/23/2023
  60.251.201[.]8	5/16/2023	3/5/2024
  60.248.88[.]151	6/8/2023	2/26/2024
  60.248.110[.]97	3/31/2023	1/4/2024
  60.249.239[.]86	9/18/2021	1/5/2022
  61.220.112[.]137	5/25/2023	5/26/2023
  60.220.84[.]41	2/9/2024	2/9/2024
  61.247.165[.]27	4/8/2022	4/11/2022
  60.220.84[.]63	10/1/2023	10/1/2023
  61.220.35[.]15	5/24/2023	9/7/2023
  61.221.55[.]4	5/24/2024	11/13/2024
  61.222.245[.]73	4/11/2023	7/25/2023
  61.219.118[.]99	12/1/2022	11/23/2023
  61.216.74[.]97	1/29/2024	1/29/2024
  64.176.38[.]35	8/30/2024	12/16/2024
  65.20.97[.]251	1/25/2024	6/5/2024
  66.42.103[.]188	11/26/2019	11/26/2019
  66.42.42[.]109	7/11/2024	8/20/2024
  66.42.40[.]189	9/4/2024	12/16/2024
  66.42.36[.]236	2/28/2024	7/25/2024
  66.42.60[.]242	2/23/2024	12/16/2024
  66.42.77[.]138	2/9/2022	6/19/2024
  77.111.226[.]5	4/19/2023	4/19/2023
  78.141.221[.]241	2/29/2020	3/10/2020
  78.141.238[.]97	1/25/2024	6/5/2024
  84.17.57[.]40	4/4/2023	4/4/2023
  89.187.163[.]216	9/19/2024	9/19/2024
  95.179.189[.]106	6/4/2020	6/4/2020
  95.179.235[.]135	1/27/2021	1/27/2021
  95.179.186[.]251	2/2/2021	2/2/2021
  98.159.37[.]4	7/4/2024	7/4/2024
  103.107.198[.]117	9/26/2023	9/26/2023
  103.16.231[.]220	3/7/2022	7/4/2024
  103.16.231[.]254	11/9/2022	2/10/2023
  103.233.253[.]197	3/19/2023	9/6/2023
  103.25.254[.]210	10/28/2019	11/26/2019
  103.149.200[.]44	4/25/2023	10/11/2023
  103.179.45[.]203	9/23/2024	12/16/2024
  103.73.160[.]232	3/17/2023	3/17/2023
  103.77.211[.]193	5/8/2024	5/8/2024
  103.106.230[.]88	6/25/2024	6/25/2024
  103.172.80[.]35	11/26/2022	11/30/2022
  104.238.149[.]146	3/6/2020	7/8/2024
  104.238.182[.]153	6/24/2020	7/1/2020
  104.238.152[.]209	2/24/2022	4/2/2022
  103.51.145[.]98	4/26/2023	5/28/2023
  103.73.162[.]99	3/17/2023	11/20/2023
  104.156.231[.]98	5/29/2020	6/2/2020
  106.53.181[.]231	5/31/2024	5/31/2024
  106.122.171[.]92	1/31/2024	1/31/2024
  108.61.181[.]104	7/11/2024	12/12/2024
  108.61.177[.]81	1/25/2024	6/5/2024
  110.42.10[.]148	4/10/2021	5/5/2021
  110.85.170[.]125	2/10/2020	2/10/2020
  111.203.153[.]245	11/5/2023	11/5/2023
  110.74.172[.]80	10/29/2021	2/17/2022
  111.55.138[.]141	7/4/2024	7/4/2024
  111.55.137[.]40	7/5/2024	7/5/2024
  111.203.153[.]95	11/5/2023	11/5/2023
  112.5.168[.]102	2/21/2022	2/21/2022
  112.5.168[.]104	3/29/2021	3/29/2021
  112.5.145[.]154	6/29/2023	6/29/2023
  112.5.143[.]161	6/27/2023	6/27/2023
  112.5.168[.]138	4/24/2022	4/24/2022
  112.5.168[.]151	7/20/2023	8/4/2023
  112.5.168[.]160	10/31/2023	11/9/2023
  112.54.132[.]162	7/3/2023	7/5/2023
  112.5.168[.]187	8/27/2021	8/27/2021
  112.5.168[.]218	8/31/2023	9/1/2023
  112.5.168[.]231	8/16/2023	8/17/2023
  112.5.168[.]234	6/5/2023	6/16/2023
  112.5.168[.]238	4/6/2023	5/18/2023
  112.51.26[.]151	6/26/2023	6/29/2023
  112.66.108[.]16	8/14/2023	8/14/2023
  112.5.168[.]29	11/11/2021	11/11/2021
  112.51.44[.]102	7/10/2023	7/18/2023
  112.51.44[.]142	6/16/2023	6/16/2023
  112.51.44[.]143	11/21/2023	11/21/2023
  112.51.44[.]188	12/15/2022	12/20/2022
  112.51.44[.]189	12/4/2023	12/4/2023
  112.51.44[.]20	11/27/2023	11/29/2023
  112.51.44[.]206	9/6/2023	9/22/2023
  112.51.44[.]217	8/6/2022	8/6/2022
  112.51.44[.]234	4/24/2022	5/5/2022
  112.5.168[.]65	3/18/2022	3/21/2022
  112.51.44[.]37	7/21/2023	8/2/2023
  112.80.50[.]138	6/5/2024	6/5/2024
  112.51.44[.]57	7/4/2023	7/5/2023
  112.5.168[.]93	3/26/2020	3/26/2020
  113.76.136[.]171	3/23/2023	3/23/2023
  114.246.237[.]111	6/4/2024	6/4/2024
  114.255.70[.]18	6/30/2022	9/1/2023
  114.255.70[.]20	9/24/2023	7/16/2024
  114.255.70[.]30	5/26/2023	7/14/2023
  114.246.93[.]103	4/18/2023	4/18/2023
  114.246.94[.]102	11/19/2023	1/11/2024
  114.35.122[.]83	3/28/2024	12/13/2024
  114.246.94[.]154	6/9/2024	6/10/2024
  114.246.92[.]58	6/8/2023	6/8/2023
  114.246.92[.]71	8/23/2023	9/11/2023
  117.133.51[.]176	3/21/2024	3/21/2024
  117.61.244[.]135	10/15/2020	10/15/2020
  117.56.214[.]246	6/8/2023	7/4/2023
  117.132.198[.]70	7/5/2024	7/5/2024
  117.92.127[.]132	3/24/2023	3/24/2023
  117.130.201[.]90	3/21/2024	3/21/2024
  118.163.217[.]199	3/12/2024	4/17/2024
  118.163.197[.]241	5/12/2023	10/16/2023
  118.163.31[.]226	5/16/2024	5/28/2024
  118.163.104[.]67	3/11/2024	12/6/2024
  118.163.142[.]80	3/20/2024	3/22/2024
  118.163.3[.]76	3/18/2024	10/29/2024
  119.116.159[.]217	3/24/2023	3/24/2023
  119.13.79[.]145	3/20/2023	3/21/2023
  120.233.10[.]212	4/2/2022	4/2/2022
  120.36.251[.]100	12/21/2023	12/21/2023
  120.36.248[.]104	1/2/2024	1/2/2024
  120.42.128[.]165	3/19/2023	3/19/2023
  120.36.250[.]103	10/20/2023	5/31/2024
  120.36.254[.]100	8/19/2021	8/19/2021
  120.36.248[.]109	5/11/2021	5/11/2021
  120.36.253[.]106	1/12/2023	1/12/2023
  120.36.255[.]105	10/29/2021	11/1/2021
  120.36.251[.]110	3/7/2024	3/7/2024
  120.36.251[.]11	6/12/2024	6/13/2024
  120.36.249[.]114	3/7/2022	3/10/2022
  120.36.251[.]114	1/4/2024	1/8/2024
  120.36.254[.]112	12/26/2022	12/26/2022
  120.36.249[.]121	6/19/2024	6/19/2024
  120.36.249[.]122	9/28/2022	9/28/2022
  120.36.254[.]119	8/19/2021	8/19/2021
  120.36.254[.]120	10/25/2023	10/27/2023
  120.36.249[.]127	2/10/2023	2/14/2023
  120.36.251[.]130	10/18/2021	10/21/2021
  120.36.255[.]127	8/5/2022	8/6/2022
  120.36.252[.]13	3/31/2023	3/31/2023
  120.36.250[.]133	7/11/2022	7/14/2022
  120.36.250[.]134	7/15/2021	7/15/2021
  120.36.250[.]135	2/25/2022	3/3/2022
  120.36.254[.]131	6/30/2023	6/30/2023
  120.36.254[.]135	8/27/2021	8/27/2021
  120.36.251[.]141	12/13/2022	12/13/2022
  120.36.250[.]142	1/12/2024	1/12/2024
  120.41.125[.]225	7/11/2023	7/11/2023
  120.36.253[.]148	8/5/2021	8/11/2021
  120.36.250[.]152	5/23/2024	5/24/2024
  120.36.252[.]151	11/15/2023	11/15/2023
  120.36.253[.]152	4/12/2021	5/19/2023
  120.36.254[.]151	3/21/2024	3/22/2024
  120.36.255[.]153	9/25/2023	9/26/2023
  120.36.252[.]157	1/28/2023	1/28/2023
  120.37.162[.]246	3/21/2023	3/21/2023
  120.36.252[.]166	9/6/2024	9/6/2024
  120.36.249[.]172	10/17/2022	10/21/2022
  120.36.253[.]169	12/10/2021	12/10/2021
  120.36.252[.]175	2/23/2023	2/23/2023
  120.36.254[.]175	5/31/2022	5/31/2022
  120.36.251[.]179	5/17/2021	5/24/2021
  120.36.253[.]178	4/28/2021	4/29/2021
  120.36.252[.]18	5/9/2024	5/9/2024
  120.36.252[.]181	4/21/2021	4/27/2021
  120.36.248[.]185	2/26/2024	2/26/2024
  120.36.253[.]180	5/15/2024	5/17/2024
  120.36.255[.]179	3/19/2024	3/20/2024
  120.36.253[.]186	2/27/2024	3/4/2024
  120.36.253[.]187	9/24/2021	9/24/2021
  120.36.250[.]19	10/9/2021	10/9/2021
  120.36.251[.]19	5/24/2021	5/24/2021
  120.36.251[.]190	8/29/2023	8/31/2023
  120.36.255[.]189	6/21/2023	6/27/2023
  120.41.244[.]15	1/25/2024	1/25/2024
  120.36.254[.]192	7/6/2021	7/7/2021
  120.36.249[.]197	8/13/2021	8/16/2021
  120.36.248[.]200	11/17/2022	11/17/2022
  120.36.253[.]195	11/22/2023	11/24/2023
  120.36.251[.]2	3/4/2022	3/4/2022
  120.36.251[.]20	4/25/2022	4/25/2022
  120.36.255[.]196	6/3/2024	6/3/2024
  120.36.251[.]202	12/24/2021	12/24/2021
  120.36.254[.]202	8/23/2021	8/25/2021
  120.36.250[.]207	7/14/2023	7/19/2023
  120.36.250[.]210	12/15/2023	12/15/2023
  120.36.249[.]213	5/9/2022	5/13/2022
  120.36.251[.]213	10/13/2023	10/16/2023
  120.36.253[.]212	4/24/2022	4/24/2022
  120.36.251[.]215	4/19/2023	4/19/2023
  120.36.252[.]215	9/8/2022	9/8/2022
  120.36.255[.]214	10/7/2023	10/7/2023
  120.36.250[.]221	11/2/2023	11/2/2023
  120.36.255[.]22	3/26/2024	3/28/2024
  120.36.251[.]230	12/4/2023	12/4/2023
  120.36.255[.]228	11/8/2021	11/11/2021
  120.36.253[.]23	11/7/2023	11/7/2023
  120.36.253[.]231	12/1/2022	12/1/2022
  120.36.251[.]234	10/12/2021	10/12/2021
  120.36.248[.]237	12/28/2021	12/28/2021
  120.36.253[.]232	3/31/2023	3/31/2023
  120.36.253[.]233	4/15/2024	4/20/2024
  120.36.249[.]238	9/20/2022	9/22/2022
  120.36.251[.]237	2/18/2022	2/24/2022
  120.36.255[.]233	2/6/2024	2/6/2024
  120.36.255[.]237	6/15/2022	6/21/2022
  120.36.249[.]245	5/24/2022	5/25/2022
  120.36.252[.]242	3/5/2024	3/6/2024
  120.36.255[.]24	9/8/2023	9/8/2023
  120.36.249[.]248	7/23/2021	7/23/2021
  120.36.250[.]247	11/25/2021	11/30/2021
  120.36.253[.]247	5/6/2021	5/6/2021
  120.36.253[.]248	4/19/2021	4/20/2021
  120.36.251[.]25	6/7/2024	6/11/2024
  120.36.251[.]254	3/22/2021	3/28/2021
  120.36.249[.]28	10/24/2022	10/28/2022
  120.36.251[.]3	12/8/2021	12/8/2021
  120.36.251[.]30	1/19/2022	1/21/2022
  120.36.254[.]3	6/30/2021	7/5/2021
  120.36.254[.]32	7/30/2024	7/30/2024
  120.36.249[.]33	11/7/2022	11/7/2022
  120.36.250[.]4	3/31/2021	3/31/2021
  120.36.250[.]43	6/8/2021	6/8/2021
  120.36.249[.]47	1/3/2023	1/3/2023
  120.36.248[.]48	3/15/2021	3/18/2021
  120.36.250[.]48	5/25/2023	5/25/2023
  120.36.249[.]52	5/16/2022	5/20/2022
  120.36.250[.]53	1/22/2024	1/22/2024
  120.36.249[.]54	9/13/2022	9/15/2022
  120.36.251[.]54	7/8/2021	7/9/2021
  120.36.249[.]55	4/7/2024	4/7/2024
  120.36.251[.]56	11/16/2022	11/17/2022
  120.36.248[.]57	6/5/2023	6/5/2023
  120.36.250[.]58	3/22/2022	3/25/2022
  120.36.250[.]6	1/14/2022	1/19/2022
  120.36.253[.]6	8/11/2021	8/12/2021
  120.36.254[.]63	3/30/2023	6/11/2024
  120.36.250[.]65	9/5/2023	9/6/2023
  120.36.251[.]65	6/22/2022	6/23/2022
  120.36.250[.]67	5/27/2021	5/27/2021
  120.36.252[.]69	4/8/2024	4/12/2024
  120.36.248[.]73	8/17/2021	8/17/2021
  120.36.255[.]74	11/19/2021	11/25/2021
  120.36.250[.]76	6/5/2024	6/6/2024
  120.41.222[.]74	11/4/2023	11/4/2023
  120.36.248[.]80	10/11/2022	10/12/2022
  120.36.251[.]80	7/27/2021	7/28/2021
  120.36.251[.]84	7/5/2022	7/5/2022
  120.36.252[.]90	4/24/2024	4/25/2024
  120.36.249[.]91	4/6/2021	4/9/2021
  120.36.251[.]91	9/29/2022	9/29/2022
  120.36.252[.]91	6/24/2022	6/27/2022
  120.36.254[.]92	9/15/2023	9/20/2023
  120.36.254[.]94	11/12/2021	11/18/2021
  120.36.248[.]97	3/14/2022	3/18/2022
  120.36.251[.]97	8/19/2021	8/19/2021
  120.36.249[.]98	2/1/2023	2/3/2023
  120.36.252[.]98	4/13/2022	4/15/2022
  121.207.60[.]123	3/19/2023	3/19/2023
  122.116.33[.]118	5/12/2023	3/5/2024
  122.232.149[.]231	3/23/2023	3/23/2023
  122.201.241[.]230	5/23/2023	8/3/2023
  122.116.159[.]52	5/22/2023	9/25/2023
  122.116.102[.]93	5/21/2024	5/21/2024
  123.121.157[.]240	4/12/2022	4/12/2022
  123.51.237[.]194	4/8/2024	11/4/2024
  123.252.121[.]7	2/26/2024	3/4/2024
  123.252.122[.]7	2/28/2024	3/4/2024
  123.12.90[.]227	1/26/2023	1/26/2023
  123.60.61[.]104	9/12/2024	9/12/2024
  124.126.158[.]130	2/21/2024	2/21/2024
  124.126.139[.]199	5/31/2023	5/31/2023
  124.127.17[.]171	8/10/2023	8/11/2023
  124.127.220[.]223	8/21/2023	8/21/2023
  124.150.135[.]3	9/7/2023	9/7/2023
  123.51.223[.]96	3/14/2023	4/18/2023
  124.64.22[.]13	12/11/2023	12/11/2023
  124.126.141[.]74	4/23/2023	4/23/2023
  124.127.78[.]22	8/15/2023	8/16/2023
  124.127.72[.]52	8/12/2023	8/12/2023
  125.227.147[.]106	11/1/2023	12/5/2023
  125.227.140[.]168	3/18/2024	11/12/2024
  125.227.1[.]220	5/25/2023	11/14/2023
  125.227.196[.]157	1/19/2024	1/29/2024
  125.227.219[.]145	3/6/2024	7/1/2024
  125.228.239[.]13	4/2/2024	12/2/2024
  125.227.218[.]2	5/16/2024	5/16/2024
  124.64.23[.]80	7/7/2023	7/7/2023
  125.229.172[.]48	5/23/2024	5/23/2024
  125.227.136[.]60	5/11/2023	2/28/2024
  137.220.34[.]137	12/16/2020	12/17/2020
  137.220.39[.]222	1/21/2021	1/25/2021
  137.220.43[.]47	7/17/2020	7/24/2020
  137.220.36[.]87	3/16/2023	7/7/2024
  138.199.62[.]148	12/5/2024	12/14/2024
  139.180.137[.]219	1/25/2024	6/5/2024
  139.180.217[.]19	6/5/2024	6/19/2024
  139.180.158[.]51	12/13/2021	7/8/2024
  139.84.174[.]129	6/17/2024	12/16/2024
  140.82.27[.]163	1/2/2020	1/8/2020
  140.82.50[.]151	3/5/2021	3/17/2021
  141.164.41[.]128	4/11/2023	7/8/2024
  140.82.48[.]6	7/13/2020	7/17/2020
  141.164.55[.]227	9/4/2024	12/16/2024
  141.164.56[.]93	6/20/2025	6/20/2025
  144.202.26[.]205	5/14/2020	5/14/2020
  144.34.171[.]162	3/29/2023	11/28/2023
  144.202.33[.]164	9/17/2020	9/27/2020
  144.202.62[.]109	10/16/2019	10/28/2019
  144.202.91[.]107	10/19/2020	10/27/2020
  144.202.94[.]216	8/17/2020	8/18/2020
  144.202.98[.]41	11/18/2020	11/18/2020
  147.139.133[.]246	5/26/2023	6/6/2023
  149.28.132[.]137	2/23/2024	7/5/2024
  149.28.132[.]161	5/17/2024	7/4/2024
  149.28.201[.]146	11/20/2020	12/11/2020
  149.28.188[.]184	11/21/2019	11/21/2019
  149.248.34[.]100	6/5/2020	6/5/2020
  149.28.149[.]29	4/30/2024	4/30/2024
  149.28.252[.]19	11/18/2019	11/18/2019
  149.248.38[.]179	6/3/2020	6/3/2020
  149.248.39[.]202	6/8/2023	2/29/2024
  149.248.44[.]191	2/23/2024	5/10/2024
  149.248.51[.]22	1/25/2024	6/5/2024
  149.28.72[.]106	2/24/2023	3/2/2023
  155.138.155[.]170	2/4/2021	2/4/2021
  155.138.136[.]190	12/5/2019	12/16/2019
  155.138.151[.]225	6/5/2024	6/5/2024
  155.138.133[.]56	1/25/2024	6/5/2024
  156.146.45[.]152	9/21/2024	9/21/2024
  156.146.45[.]194	9/19/2024	9/19/2024
  158.247.197[.]28	6/25/2023	9/26/2023
  159.138.152[.]61	3/16/2023	3/22/2023
  162.14.178[.]86	3/29/2021	5/7/2021
  167.172.33[.]16	4/14/2023	4/14/2023
  167.179.87[.]215	11/21/2022	6/20/2025
  167.179.97[.]121	12/14/2022	3/20/2023
  171.120.88[.]137	9/27/2023	9/27/2023
  178.62.208[.]162	4/14/2023	4/14/2023
  180.122.149[.]177	3/22/2023	3/22/2023
  182.34.19[.]234	3/23/2023	3/23/2023
  183.240.139[.]216	12/7/2020	1/8/2021
  183.253.28[.]104	2/27/2024	2/27/2024
  183.253.29[.]110	5/6/2024	5/10/2024
  183.253.28[.]121	12/6/2023	12/14/2023
  183.250.213[.]20	4/3/2023	4/3/2023
  183.253.29[.]189	8/9/2024	8/9/2024
  183.250.213[.]55	9/26/2023	10/11/2023
  183.253.29[.]66	3/25/2024	3/28/2024
  183.253.28[.]67	10/12/2024	10/12/2024
  183.250.213[.]80	3/3/2023	3/31/2023
  183.250.213[.]83	3/24/2023	3/24/2023
  183.166.90[.]97	3/20/2023	3/20/2023
  185.216.118[.]71	6/7/2024	7/2/2024
  185.135.73[.]192	1/4/2022	1/5/2022
  185.213.82[.]239	6/27/2024	7/3/2024
  185.213.82[.]243	6/28/2024	6/28/2024
  185.213.82[.]55	10/16/2024	10/16/2024
  185.213.82[.]65	9/21/2023	9/21/2023
  190.92.241[.]15	3/20/2023	3/27/2023
  191.232.188[.]144	6/23/2022	6/23/2022
  193.42.24[.]68	11/28/2024	11/28/2024
  193.42.25[.]73	3/24/2024	7/11/2024
  198.13.38[.]211	7/5/2024	7/5/2024
  202.182.109[.]151	6/1/2024	9/13/2024
  202.101.145[.]22	3/23/2023	3/23/2023
  202.182.106[.]31	1/25/2024	7/2/2024
  202.39.151[.]239	3/8/2024	12/5/2024
  202.99.19[.]250	7/10/2023	7/10/2023
  202.99.19[.]254	7/13/2023	7/13/2023
  203.74.126[.]20	3/28/2023	3/31/2023
  203.69.36[.]122	4/1/2024	12/12/2024
  207.246.118[.]144	10/21/2022	12/15/2022
  207.246.117[.]149	3/24/2020	3/27/2020
  207.246.114[.]173	10/30/2019	10/30/2019
  207.148.68[.]131	1/25/2024	6/5/2024
  207.148.122[.]69	1/25/2024	6/5/2024
  207.148.67[.]146	1/6/2021	1/20/2021
  207.246.108[.]64	1/16/2020	1/16/2020
  207.246.127[.]64	9/12/2019	9/6/2024
  207.148.73[.]238	6/14/2023	9/13/2024
  207.148.92[.]220	4/25/2024	7/5/2024
  207.148.4[.]96	9/30/2019	5/18/2023
  208.72.154[.]55	4/24/2022	5/17/2022
  210.242.152[.]155	3/26/2024	12/12/2024
  210.242.38[.]241	3/14/2023	1/15/2024
  210.243.225[.]41	5/14/2024	11/29/2024
  210.66.220[.]39	10/18/2021	10/21/2021
  210.242.76[.]32	5/23/2024	5/23/2024
  210.71.166[.]50	6/3/2024	6/11/2024
  211.20.144[.]116	5/16/2024	5/19/2024
  211.20.104[.]187	5/21/2024	5/21/2024
  211.21.19[.]11	3/6/2024	4/2/2024
  211.22.143[.]228	7/27/2023	7/27/2023
  211.20.115[.]60	2/27/2023	3/5/2024
  211.20.154[.]60	3/18/2024	4/1/2024
  211.20.100[.]78	12/21/2023	12/22/2023
  211.20.100[.]79	12/22/2023	12/22/2023
  211.99.103[.]102	12/1/2020	12/8/2020
  211.21.61[.]46	4/2/2024	4/29/2024
  211.75.185[.]37	10/30/2023	1/4/2024
  211.99.103[.]243	12/28/2020	1/22/2021
  212.107.28[.]16	9/9/2022	9/9/2022
  212.107.28[.]22	9/9/2022	9/9/2022
  212.107.28[.]23	9/9/2022	9/9/2022
  211.78.84[.]17	12/27/2023	12/27/2023
  211.20.91[.]77	4/17/2024	4/18/2024
  211.99.100[.]90	4/8/2021	4/8/2021
  211.99.100[.]91	4/9/2021	4/9/2021
  211.99.98[.]197	11/30/2020	11/30/2020
  216.128.149[.]106	12/15/2022	2/22/2023
  216.128.128[.]238	2/21/2021	2/21/2021
  218.26.159[.]254	10/5/2023	10/5/2023
  218.5.173[.]137	3/22/2023	3/22/2023
  218.5.157[.]171	3/20/2023	3/20/2023
  218.66.163.188	3/24/2023	3/24/2023
  219.143.179[.]250	7/10/2023	7/13/2023
  220.128.108[.]164	10/28/2022	7/19/2023
  220.130.153[.]127	4/3/2023	12/18/2023
  220.130.176[.]23	12/18/2023	3/1/2024
  220.128.125[.]3	3/8/2023	5/9/2023
  220.130.254[.]251	12/13/2023	12/13/2023
  219.92.229[.]53	5/15/2023	5/15/2023
  220.162.9[.]150	3/20/2023	3/23/2023
  220.250.44[.]62	6/28/2023	6/29/2023
  221.218.143[.]112	2/29/2024	3/11/2024
  221.218.136[.]12	7/16/2023	8/9/2023
  221.218.138[.]123	5/23/2024	5/23/2024
  221.218.143[.]122	6/4/2023	7/3/2023
  221.218.143[.]184	7/5/2023	7/12/2023
  221.218.136[.]192	10/8/2023	11/15/2023
  221.216.116[.]238	4/24/2024	4/24/2024
  221.218.137[.]229	6/4/2024	6/4/2024
  221.218.139[.]248	1/18/2024	1/24/2024
  221.216.208[.]188	6/19/2023	6/19/2023
  221.218.142[.]26	5/9/2024	5/13/2024
  221.218.141[.]96	4/2/2024	4/3/2024
  222.92.153[.]125	6/6/2024	6/6/2024
  223.104.40[.]128	4/16/2024	4/16/2024
  223.104.41[.]13	4/18/2024	4/18/2024
  223.104.40[.]142	4/17/2024	4/17/2024
  223.104.40[.]204	4/19/2024	4/19/2024
  223.27.34[.]132	4/10/2024	12/13/2024
  223.104.55[.]183	7/3/2024	7/3/2024
  223.104.39[.]82	7/11/2023	7/11/2023

   

  Table 12 shows observed domain names attributed to this threat activity and obfuscation network hosts.  

  Table 12. Domain Names Attributed to Threat Activity and Obfuscation Network Hosts 

  Name	Type	First Seen	Last Seen
  96cee[.]com	Infrastructure	6/29/2020	5/9/2024
  asean.twimg.co[.]uk	SoftEther Host	9/21/2024	12/15/2024
  bj-hk.hmbcloud[.]net	SoftEther Host	3/29/2021	3/29/2021
  bj-jp.hmbcloud[.]net	SoftEther Host	4/10/2021	5/7/2021
  blog.98aiblog[.]com	SoftEther Host	7/12/2024	8/14/2024
  bsnl.twimg.co[.]uk	SoftEther Host	6/17/2024	7/7/2024
  dns.studiocloud[.]xyz	Infrastructure	12/10/2021	5/9/2024
  eg.twimg.co[.]uk	SoftEther Host	9/22/2024	12/14/2024
  etechhosting.twimg.co[.]uk	SoftEther Host	9/21/2024	12/16/2024
  fcchk.twimg.co[.]uk	SoftEther Host	9/21/2024	12/14/2024
  gz-hk.hmbcloud[.]net	SoftEther Host	12/28/2020	1/22/2021
  iplc-hk.hmbcloud[.]com	SoftEther Host	11/30/2020	12/8/2020
  javacheck.ooguy[.]com	SoftEther Host	12/22/2023	6/25/2024
  javaupdate.giize[.]com	SoftEther Host	12/22/2023	6/15/2024
  ls.twimg.co[.]uk	SoftEther Host	9/21/2024	12/14/2024
  np.twimg.co[.]uk	SoftEther Host	9/21/2024	11/25/2024
  one.hmbiplc-01[.]com	SoftEther Host	4/2/2022	4/2/2022
  pw.sexytube0[.]com	SoftEther Host	8/6/2021	4/18/2024
  senate.twimg.co[.]uk	SoftEther Host	9/21/2024	12/14/2024
  sh-jp.hmbcloud[.]net	SoftEther Host	4/10/2021	4/25/2021
  studiocloud[.]xyz	Infrastructure	12/10/2021	5/9/2024
  szxcm-hkg01.iepl.node[.]cm	SoftEther Host	12/7/2020	1/8/2021
  tj.twimg.co[.]uk	SoftEther Host	9/21/2024	12/14/2024
  ximmd.sexytube0[.]com	SoftEther Host	7/14/2020	10/31/2020

   

  Table 13 contains known webshells from the threat actor’s repository of CNE tooling, which may appear on a compromised system. The threat actors have used these webshell files for unauthorized access to victim environments. 

  Table 13. Leveraged Webshells 

  Name	Hashes
  b374.php	MD5:48ca18a25424a0f52276290b619a7a83  SHA-256:72c6af6a4be99e31c4a7a0aa4f01750792788e7f6f9749243a9f2c47c14a708f
  back.pl	MD5:38f5ff8169423e2c756848c02e8cac3b  SHA-256:456586ababa08f70216c4459f4d6375676166ebfddd98a33b447ceb5099e8dc5
  error.jsp	MD5:d61326c4e6d24aa9b67e2b7a3ef7cedf  SHA-256:2f5c406eb64ad8902c8e30610d43fd3efc05a14cdb8fb158818953eaf3dc6a81
  file_back.  aspx	MD5:f8de2e99dc7523d2c83d1a48e844c5ff  SHA-256:5782ff2c835c88cc1ee521d2e8c523cfad73db3f9a29c93b40c4223f0338ade9
  gf.phtml	MD5:5b5a2c7fa705d8b1eb04da5db900b0d7  SHA-256:0e6fecb2d369b0eae63731616a3daada52036634885ab1b85b115af6bc5bcb86
  yaml-payload.jar	MD5: 655cd134976d3e80c521708aa8be418b  SHA-256:36f3b7645609ef40444dbc68f01d26c543d67689eda4937272ea5cfa4df1b522

   

  Table 14 contains known binaries and scripts from the threat actor’s repository of CNE tooling. The threat actors used these utilities to perform various scanning or computer intrusion tasks.

   

  Table 14. Leveraged Binaries and Scripts 

  Name	Category	Hashes
  ksubdomain	Enumeration	MD5: dae8f50ea44225fae3ba1f160b42bfdc  SHA-256:670fa10a2ddde21fd594c4fef86b554d864089ed2de7153b472e921c623403ae
  ksubdomain_linux	Enumeration	MD5:fdece34bc084f1e252aeae274650eb8d  SHA-256:645f6f2667af01a94d04a9d7a71916a13d9426835d636b4ceee2e25ccb34e525
  oneforall.py	Enumeration	MD5: 596b990b0b389d906a8f4384837c1878  SHA-256:4d488f21269b18e37aaca93ac2a61707c9b611e506cdb3b287277746e94636b5
  subDomainsBrute.py	Enumeration	MD5:a73eca669fe80628dbbd2c7d9bb14c8f  SHA-256:a14844e982f172d0f23910558c3f390a9d4c45dc32db825c2af7cf0ed8631db2
  office-cli	Information dump	MD5:be121e707f817aa9392c55af1e7ec2aa  SHA-256:add7dd142e4f7e2873bc8f7b7fb6308063608e0b49a773dea93abad4047f1489
  JuicyPotato.exe	Privilege escalation	MD5:7ce68f0dd85355ba2897a68521167e56  SHA-256:e7e727458f573dded05537baddac2867d2801db1c3c74410398d063dfd6f6575
  BBScan.py	Scanning	MD5:f82694de2f19e1bff333c27bb7eb7a56  SHA-256:8e1b56ef51ba70aa4c4cfd4430820f20875b354588d5d723ba4d3940ea6c924b
  dirmap.py	Scanning	MD5:1933c314041415939331fce183939547  SHA-256:46e59172c40c95d83c3a6f24f801fc2265653c8b575b66a726463e2a4eebd7f2
  dirsearch.py	Scanning	MD5:8829f6f1cc5fc0aab2f6e71bfd7dc53d  SHA-256:752b14c6e6936991d51fcd5ebf40d303e657c2372893604f96044848ad9a5f24
  fscan.exe	Scanning	MD5:cf903e4a1629aa0582fd0363b5786676  SHA-256:7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9
  nbtscan.exe	Scanning	MD5:f01a9a2d1e31332ed36c1a4d2839f412  SHA-256:c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e
  nbtscan_linux	Scanning	MD5:ef713447f18f5b7ee16af4ac37ec4133  SHA-256:2fbcb1995c458e5affd5fb8f1f979a08ddce21714a2e413aa3d5dc44f9f245fe
  PackerFuzzer.py	Scanning	MD5:8dcc4f9ccc6b6adf7eeeb3f51c95afad  SHA-256:33790218d5871af646feef5be29e0596d4703a45ce675c1eb2ca00140b3a1bde
  ShuiZe.py	Scanning	MD5:b04375cca637f0702bf27feaff22a92d  SHA-256:c7f86a4623db5c90273cea041d43207849c5c6b0060c370b2095f13871b1366d
  sqlmap.py	Scanning	MD5:bcacc7ca999980d26c186ef791242fb5  SHA-256:2ecb51d7fa3bc3fa7ad7df64c6d0cd1f4ff2b37ed6839d3cff529fb08af49fb0
  wpscan	Scanning	MD5:1b8e29b6b7972fb124425aaa257f8f6d  SHA-256:efb0437e6a6a0f07169952f1a8b734299ec9a8b1faadbed811fe017f2cf54976

   

  Table 15contains known files that the threat actors dropped onto victim systems and used to install unauthorized software, dump sensitive information, or enable other follow-on activity from within a victim’s network. 

  Table 15. Potentially Dropped Files 

  Name	Category	Hashes
  curlc4.txt	Malware	MD5:4f61b9ab907f351bb40b37b10f4974d0  SHA-256:8b869a5edaff74ff18bca3658a519a19771e66d00ff7849af7a142dd6fc8da85
  DiagTrack.exe	Malware	MD5:6d57c42dee8bd7789969e2dd28671162  SHA-256:804a53be802378a8ec4c94602fd3d6584e0d472d83148e8a42c731950fec415d
  live700_v1.exe	Malware	MD5:776807750280daad05348f931a33e4ef  SHA-256:c4503db6ece93eddf4511e787607cb14606a1df9f526f1e39992497119437cec
  conhost.exe	SoftEther	MD5:a973c0ab904c1b74655a906b99b76850  SHA-256:b1552703ff0035f197c22cdb3a514bb6aa45ec98de3ef5409faab0978f18c35e
  dllhost.exe	SoftEther	MD5:f62cbbbdf35c7790909c26c7c5fbce05  SHA-256:8a592e22c51311d482272ec5aba0103c9cd0cfd78e5b5ba75dfa8f1c56926672
  dllhost.exe	SoftEther	MD5:a05cdf6afcbb107961307f59cbab5e4f  SHA-256:86f1cfa6a2e0a8cb6fc1fbee28472308e6467932f8658a6a4885e29ed8c34a67
  b.exe	Information dump	MD5:7d5a182f70bed0e4fa2f8615aba070de  SHA-256:e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784
  dc.exe	Information dump	MD5:1bcaef76b2063f1b80b0fa0d277ec9c5  SHA-256:9dc85f9569a15eaf51c7d34254767ea30dd67b2178cec4cc7125288b9544fe00
  secretsdump.exe	Information dump	MD5:4d33bfb75e27fefaa72526899604d557  SHA-256:644decbc6ce8c52382f4755fa6fc2cb4d89a0e7ec0e574c11b398a6f2eed04b1
  secretsdump.py	Information dump	MD5:fc6e8ca41cf4f6100177352660e520b4  SHA-256:67db57a1f957031b78f29aa91e2e87780eae3835290259eff846d8f14afb794b

   

  Appendix B: Observed Common Vulnerabilities and Exposures

  Table 16displays successfully exploited common vulnerabilities and exposures (CVEs). The asterisk (*) indicates CVEs that were newly added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog. 

  Table 16. Successfully Exploited CVEs 

  CVE	Vendor	Product	Versions Affected	Vulnerability Type
  CVE-2014-6278 [Common Weakness Enumeration (CWE)-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)]	GNU	Bash	Through 4.3 bash43-026	Remote code execution
  CVE-2015-3306* [CWE-284: Improper Access Control]	ProFTPD	Proftpd	1.3.5	Unauthorized read
  CVE-2015-5477* [CWE-19: Data Processing Errors]	ISC	BIND 9.x	Before 9.9.7-P2 and 9.10.x before 9.10.2-P3	Denial of service
  CVE-2016-3081* [CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)]	Apache	Struts	2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28	Remote code execution
  CVE-2019-11510 [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)]	Pulse Secure	Pulse Connect Secure	8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4	Unauthorized read
  CVE-2021-22205 [CWE-94: Improper Control of Generation of Code (‘Code Injection’)]	GitLab	GitLab	All versions starting from 11.9	Remote code execution
  CVE-2021-3199* [CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)]	ONLYOFFICE	DocumentServer	5.1.5 through 5.6.2	Unauthorized write
  CVE-2023-22894* [CWE-312: Cleartext Storage of Sensitive Information]	Strapi	Strapi	Up to 4.5.5	Information disclosure

   

• China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

  Executive summary

  China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) (hereafter referred to as the authoring agencies) are releasing this joint Cybersecurity Advisory to alert organizations about these malicious activities and techniques and recommend mitigations to reduce their potential impact. 

  Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models. Alibaba leveraged industrial-scale distillation to improve the company’s Qwen family of AI models. Moonshot AI, MiniMax, Stepfun, and Z.AI also engaged in malicious knowledge distillation of U.S. AI companies’ models. 

  China-based AI companies route distillation requests through multiple pathways to gain unauthorized access, consequently violating U.S. AI companies’ terms of use. These pathways include native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection. Further, China-based AI companies use a gray market of proxies known as “transfer stations” to bypass U.S. AI companies’ geographic restrictions, breach terms of use, evade safeguards, and undermine traceability. China-based AI companies achieve cost savings for their industrial-scale distillation campaigns through bulk procurement of the U.S. AI companies’ premium subscriptions shared across teams of developers. Advanced industrial-scale distillation tactics include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures. China-based AI companies that conduct industrial-scale distillation against U.S. AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model.

  China-based AI companies deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection. They also attempt to distill the best capabilities and proprietary features of each U.S. frontier model to train their China-based AI models. This represents systematic extraction of proprietary functionalities and capabilities threatening U.S. technological leadership. Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. Government, private industry, and allied nations.

  The authoring agencies recommend U.S. AI companies take three immediate actions: 

  1. Implement comprehensive detection and mitigation:Detect anomalous and malicious prompts, accounts, networks, and behaviors. Additionally, monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.
  2. Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.
  3. Establish cross-organization intelligence sharing:Correlate activity across model providers, cloud platforms, and API aggregators to reveal distributed campaigns.

  Attribution

  Since at least late 2024, China-based AI companies, including DeepSeek (DeepSeek Artificial Intelligence Technology Research Co., Ltd.), Moonshot AI (Beijing Moonshot Technology Co., Ltd.), Alibaba Group, MiniMax (Shanghai MiniMax Co., Ltd.), StepFun (Shanghai Jieyue Xingchen Intelligence Technology Co., Ltd.), and Z.AI, have conducted high-volume knowledge distillation campaigns against several U.S. AI companies. The sheer scale of these campaigns and their sophistication indicate that distillation is not a supplement to these companies’ AI model development, but the critical core of it. 

  Likely with the knowledge of the Chinese government, the China-based AI sector has turned to a comprehensive distillation strategy in an attempt to bridge the technological and performance gaps between their AI models and U.S. frontier AI models. To access U.S. AI companies’ application programming interfaces (APIs), China-based AI companies use a gray market of API proxies known as “transfer stations” to bypass U.S. AI companies’ regional restrictions, breach terms of use, evade safeguards, and undermine traceability. 

  DeepSeek

  DeepSeek has been conducting an organized distillation campaign against U.S. AI companies’ frontier AI models since at least late 2024 to generate synthetic training data for its models, including R1, released in early 2025. The company targeted specific knowledge domains to extract proprietary functionality and reasoning capabilities to reduce their compute and research costs. DeepSeek’s publicly quoted training costs of $5.6M are misleading as it does not include the true cost of the data acquired through extensive malicious distillation.¹ 

  Between late 2024 and mid-2025, DeepSeek distilled specialized training data and capabilities from the following U.S. frontier AI company models to train their R1 and V3 models: 

  • Claude 3.7 
  • Claude Sonnet 4
  • Claude Sonnet 4.5
  • Claude Opus 4.1
  • Gemini 2.5 Pro Preview
  • Gemini 2.5 Flash Preview
  • GPT-4
  • GPT-4o
  • GPT-4 Mini
  • GPT-4 Nano
  • GPT-5
  • Grok 4

  The specific knowledge and capabilities distilled included: 

  • Legal specialization optimization
  • API rule-driven tasks
  • Writing using CoT drafts
  • Agentic functions
  • Question and answer optimization
  • Coach/assistant capabilities
  • Functional creation optimization
  • Supervised fine-tuning (SFT) optimization
  • Creative and occupational writing optimization

  Moonshot AI 

  Moonshot AI has conducted a widespread distillation campaign against U.S. frontier AI companies since at least mid-2025. Notably, Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model. The company has used the following models to distill SFT optimization, reinforcement learning (RL), software engineering, and math capabilities:

  • Claude Opus 4.1
  • Claude Sonnet 3.7
  • Claude Sonnet 4
  • Claude Sonnet 4.5
  • Claude Sonnet 4.5 Thinking
  • Claude Fable 5
  • GPT-oss-20b
  • GPT-3
  • GPT-4o
  • GPT-4o mini
  • GPT-5
  • GPT-5 Codex
  • GPT-5 Pro
  • Gemini 2.5 Flash
  • Gemini 2.5 Flash-Image
  • Gemini 2.5 Pro
  • Nano Banana
  • Grok Code Fast-1

  Other companies

  Several other China-based AI companies, including Alibaba, MiniMax, StepFun, and Z.AI have also leveraged distillation techniques to build their AI models. In late 2025, Alibaba distilled Claude-4, Claude Opus, Claude Sonnet, and GPT-5 to improve their AI models’ software engineering skills, customer service dialogue functionality, image/character creation, and integration of RL, SFT, and distillation capabilities.

  In late 2025, MiniMax distilled CoT reasoning, RL, SFT, and software engineering capabilities to improve its M2 model from Claude Code, Claude Sonnet 4, Claude Opus, Gemini 1, Gemini 2.5 Pro, and Gemini 3 Pro. MiniMax used Claude Code for internal software development tasks, including code generation, analysis, and refinement. MiniMax even used prompt injections to try to trick Claude Code into believing it was a MiniMax product.

  Between late 2025 and early 2026, StepFun distilled data from Claude Opus 4.1 and 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, GPT-5 Mini, GPT-5 Pro, GPT-5.1, GPT-5.1 Codex, and GPT-5.2 to improve its Step 4 model’s coding and agentic functions. By mid-2026, Z.AI had distilled billions of tokens of GPT-5.5 data and Claude Opus 4.8 data to develop the CoT reasoning capabilities of its model.

  Table 1: China-based AI Companies Engaged in Knowledge Distillation Against U.S. AI Companies (From at least 2024-2026) 

  China-based AI Company	U.S. AI Models Distilled	Functionalities and Domains Distilled
  DeepSeek  (DeepSeek Artificial Intelligence  Technology Research Co., Ltd.)  深度求索AI基础技术研究有限公司	Claude Sonnet 3.7  Claude Sonnet 4  Claude Sonnet 4.5  Claude Opus 4.1  Gemini 2  Gemini 2.5 Pro Preview  Gemini 2.5 Flash Preview   GPT-4  GPT-4o  GPT-4 Mini  GPT-4 Nano  GPT-5  Grok 3 Mini   Grok 4	Legal specialization optimization  API rule-driven tasks  Writing using CoT drafts  Question and answer optimization  Coach/assistant capabilities  Functional creation optimization  SFT optimization  Agentic capabilities  Creative and occupational writing optimization
  Moonshot AI  (Beijing Moonshot Technology Co., Ltd.)  北京揽月星辰科技有限公司	Claude Opus 4.1  Claude Sonnet 3.7  Claude Sonnet 4  Claude Sonnet 4.5  Claude Sonnet 4.5 Thinking  Claude Fable 5  GPT-oss-20b;  GPT-3  GPT-4o mini  GPT-5  GPT-5 Codex  GPT-5 Pro  Gemini 2.5 Flash  Gemini 2.5 Flash-Image  Gemini 2.5 Pro  Nano Banana  xAI Grok Code Fast-1	SFT  RL  Software engineering  Math capabilities
  Alibaba  阿里集团	Claude 4  Claude Sonnet  GPT-5	Customer service dialogue  Virtual character creation  SFT, RL, and distillation training  Evaluating and training datasets  End-to-end agentic workflows  Software engineering
  MiniMax  (Shanghai MiniMax Co., Ltd.)  上海稀宇极智科技有限公司	Claude Code  Claude Sonnet 4  Claude Opus 4.5  Gemini 1  Gemini 2.5 Pro  Gemini 3 Pro  GPT-5	CoT reasoning  Agentic functionality  Code review  SFT dataset refinement  Software engineering tasks
  StepFun  (Shanghai Jieyue Xingchen  Intelligence Technology Co., Ltd.)  上海阶跃星辰智能科技有限公司	Claude Opus 4.1  Claude Opus 4.5  Claude Sonnet 4.5  Claude Haiku 4.5  GPT-5 Mini  GPT-5 Pro  GPT-5.1  GPT-5.1 Codex  GPT-5.1 Codex Mini  GPT-5.2	Code development  Agentic functions
  Z.AI 北京智谱华章科技有限公司	GPT-5.5  Claude Opus 4.8	CoT reasoning

  Tactics, techniques, and procedures

  China-based AI companies employ sophisticated tactics, techniques, and procedures (TTPs). These TTPs map to the MITRE® ATLAS™² framework, progressing through multiple adversary lifecycle phases from initial access through exfiltration. The China-based AI companies using these techniques include DeepSeek, Moonshot AI, MiniMax, StepFun, Z.AI, and other China-based AI companies targeting U.S. frontier AI models.

  Table 2: MITRE ATLAS Mappings 

  TTP Title	ID	Description
  Resource Development
  Acquire Infrastructure	AML.T0008	China-based entities establish and maintain sophisticated infrastructure supporting sustained extraction operations through tiered budget management and diverse supplier relationships.  China-based entities circumvent both Chinese and U.S. AI access controls through a large gray market of API proxies, or “transfer stations,” which resell access to frontier models at a fraction of the official price. In doing so, they create a scalable mechanism for evading provider safeguards and eroding traceability.
  AI Model Access
  AI Model Inference API Access	AML.T0040	China-based entities have been exploiting AI model inference APIs through the creation of fraudulent accounts that are not registered to legitimate users. These actors leverage multiple accounts with similar registration details and payment methods, frequently switch between various AI models, and utilize third-party API aggregator services. Additionally, they execute highly coordinated queries featuring identical or similar prompt texts, demonstrating a sophistication indicative of advanced AI research. The sheer volume of requests, ranging from thousands to millions on similar topics, far exceeds legitimate use, raising significant concerns about potential misuse and compromising the integrity of AI systems.
  Execution / Privilege Escalation / Defense Evasion
  LLM Prompt Injection    LLM Jailbreak	AML.T0051      AML.T0054	China-based entities have conducted prompt injection techniques against large language models (LLMs) by inserting prompts specifically designed for jailbreaking.   China-based entities craft prompts forcing models to reveal their hidden CoT reasoning (CoT or step-by-step internal reasoning that enables greater capabilities) despite U.S. models restricting CoT output visibility to users. DeepSeek employed prompts instructing models to imagine and articulate the internal reasoning behind completed responses and write it out step by step. This CoT data teaches student models, not just factual knowledge, but reasoning methodologies for complex agentic tasks, coding challenges, and logical proofs.
  Discovery
  Discovery	AML.TA0008	China-based entities employ aggressive, adaptive discovery to systematically identify valuable extractable data.  China-based entities demonstrate rapid operational adaptation. MiniMax redirected exchanges to a new Claude model within 24 hours of release, demonstrating real-time provider monitoring and pre-positioned infrastructure for immediate retargeting.
  AI Attack Staging
  Verify Attack	AML.T0042	China-based entities deploy production-grade automated quality assurance pipelines with multi-modal validation, enabling rapid detection of degraded outputs and differentiation of service issues from defensive data degradation.
  Collection
  Collection	AML.TA0009	China-based entities systematically collect outputs to generate synthetic training datasets through continuous API querying, targeting specific knowledge domains rather than indiscriminate gathering.  Moonshot AI used millions of exchanges targeting agentic reasoning/tool use, coding/data analysis, computer-use agent development, and computer vision, evolving from text-based distillation to extracting logical frameworks, enabling tool interaction and visual processing.  DeepSeek used queries targeting reasoning capabilities, rubric-based grading tasks (reward model function), and censorship-safe query rewriting, extracting how U.S. models evaluate response quality.  Campaigns span days to months with query volumes in the thousands to millions per domain, far exceeding legitimate research or development use cases.
  Exfiltration
  Exfiltration via AI   Inference API: Extract AI Model	AML.T0024.002	China-based entities have been collecting U.S. frontier LLMs’ inferences into datasets, which can be used to train their models to mimic the behavior and performance of these LLMs.
  Impact
  External Harms	AML.T0048	China-based entities inflict financial harm through systematic extraction of proprietary functionality and capabilities, causing significant economic losses. Extracting capabilities worth billions in development costs while undermining competitive advantages represents a strategic economic threat to fair technological competition and U.S. technological leadership.

  Novel TTPs

  China-based AI companies leverage techniques not in MITRE ATLAS, demonstrating significant organizational investment, operational maturity, and adaptive capability development distinguishing these campaigns from opportunistic exploitation.

  Novel TTP 1: Regional restriction evasion and subscription exploitation

  Some U.S. frontier AI models are restricted for use; however, China-based AI companies access U.S. frontier AI models by employing various means to bypass the regional restrictions.

  After bypassing the restriction, China-based AI companies create user accounts obfuscating their country of origin and subsequentially procure bulk premium AI subscription services.

  StepFun structured access around pools of accounts with employees running multiple concurrent sessions, implementing load distribution to prevent quota depletion. Daily budget allocations per automated agent started at moderate levels, scaling significantly as operations matured.

  Detection indicators include:

  • shared accounts from multiple IPs/user agents, 
  • 24/7 sustained usage without human variation/idle periods, 
  • anomalous subscription-to-API usage ratios, and 
  • new subscriptions immediately at maximum usage as opposed to gradual AI adoption.

  Novel TTP 2: Centralized request routing infrastructure

  China-based AI companies deploy sophisticated tools that enable unified control and scalable implementation for evasion at scale. This provides model/provider abstraction, real-time health monitoring, centralized quota enforcement, and automated sanitization.

  China-based AI companies manage routing systems to external AI models for distillation. These routing systems direct requests through multiple pathways: native APIs, cloud providers, third-party aggregators, third-party relays, and vendor account pools.

  Detection indicators include:

  • consistent operational patterns across diverse account pools and 
  • correlated timing/behavior across different pathways indicating unified orchestration.

  Novel TTP 3: Automated request metadata sanitization

  China-based AI companies implement automated sanitization to systematically remove organizational identifiers. This differs from AML.T0065 (LLM Prompt Crafting) by operating at an infrastructure layer with automated enforcement instead of manual modification.

  Detection indicators include:

  • sudden behavioral changes following disclosures/sharing, especially abrupt disappearance of previously consistent metadata; 
  • absence of expected markers in high-volume campaigns where scale suggests institutional activity; and 
  • generic/randomized patterns replacing consistent organizational indicators.

  Novel TTP 4: Systematic quota and cost optimization

  China-based AI companies systematically minimize API costs through pathway selection prioritizing cost-efficiency, centralized quota allocation/budget alignment, and account segmentation by purpose.

  Detection indicators include:

  • new accounts with anomalously high immediate hit rates suggesting bulk deployment with pre-engineered templates, 
  • usage optimized for cache maximization versus task diversity, and 
  • coordinated pathway switching responding to pricing/rate changes indicating centralized decision-making.

  Mitigations

  Coordinated, ecosystem-wide responses extending beyond individual company measures can help address knowledge distillation campaigns. The mitigations below incorporate mitigations from the MITRE ATLAS and National Institute of Standards and Technology (NIST) AI frameworks. Collaboration across the broader AI ecosystem, including cloud providers, API aggregators, and infrastructure providers, can enable a coordinated defense against malicious knowledge distillation campaigns.

  Behavioral detection and monitoring

  China-based AI companies leverage premium subscriptions to U.S. frontier models for knowledge distillation campaigns and code development. U.S. companies should strengthen identity verification for accounts and track individual subscriptions with enterprise-scale throughput, accounts deviating from legitimate patterns, and new accounts immediately at maximum usage versus a gradual ramp-up or with consistent quota exhaustion. 

  Response alteration for suspected distillation activity

  Employing targeted changes in response to high-confidence malicious distillation requests can impose meaningful costs on knowledge distillation campaigns. Response changes, such as including differential privacy or using less sophisticated “downgraded” models to respond to distillation requests, can help protect U.S. proprietary functionalities and capabilities and reduce payoffs from distillation attempts. 

  Implementation strategies

  When suspecting a malicious distillation campaign, consider varying changes to responses across requests to complicate response quality evaluations, such that the subtle changes avoid triggering obvious alerts. Reducing reasoning depth, presenting correct information with different reasoning, or stylistic inconsistencies may evade detection while reducing training usefulness.

  Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model. Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training. Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them. In contrast, AI safety researchers and third-party evaluators should be informed of model changes while still applying strong distillation mitigations.

  Cross-organization information sharing and ecosystem coordination

  Sharing information about distillation campaigns, such as indicators of infrastructure distributing operations across multiple providers, platforms, and pathways, can improve individual companies’ detection efforts. Industry disclosures document proxy networks managing tens of thousands of fraudulent accounts simultaneously, mixing distillation with unrelated customer requests across multiple providers. Community collaboration could provide defenders with more comprehensive visibility across the native APIs, cloud endpoints, and aggregators.

  Sharing information about distillation enables and enhances correlation otherwise unachievable by individual organizations, through sharing infrastructure indicators (IPs, domains, third-party service providers) and behavioral indicators (timing correlations, query volume patterns).

  Multi-source correlated activity enables more confident attribution of malicious knowledge distillation campaigns, justifying response degradation with lower-to-no legitimate user risk.

  Sharing infrastructure and behavioral indicators between cloud providers, model aggregators, and model providers can make distributed infrastructure visible as coordinated campaigns versus isolated anomalies. Additionally, sharing can provide cloud and routing companies with actionable indicators for identifying and mitigating malicious activity.

  MITRE ATLAS mitigations 

  • AML.M0015 - Predictive AI Adversarial Input Detection: Detect/block atypical queries deviating from benign patterns, exhibiting previous adversary technique characteristics, or originating from malicious IPs.
  • AML.M0004 - Limit AI Service Query Volume and Rate: Per-key/IP quotas, rate limits, progressive throttling. Adversaries seem to be sensitive to rate limits since they implement sophisticated strategies to work within constraints. 
  • AML.M0019 - Control Access to AI Models and Data in Production: User verification, authenticated API access, policy monitoring. This addresses fraudulent account pool exploitation. 
  • AML.M0024 - AI Telemetry Logging: Log inputs/outputs for threat detection/forensics. This is foundational for behavioral detection and enables correlation with intelligence. 
  • AML.M0002 - Predictive AI Output Obfuscation: Reduce fidelity of responses (withhold logits/confidences, shorten responses, targeted redaction). Balance security with user experience. 
  • AML.M0035 – AI Red Team: Adversarial testing, extraction simulation, telemetry monitoring. Validates detection efficacy. 
  • AML.M0015 - Predictive AI Adversarial Input Detection: Sanitize/validate inputs preventing prompt injections. This addresses jailbreak and injection attempts to elicit reasoning traces and system prompts. 
  • AML.M0000 - Limit Public Information Release: Limit disclosure of architecture, prompt templates, and system instructions. 
  • AML.M0001 - Limit Model Artifact Release: Limit release of data, algorithms, architectures, and model checkpoints. 
  • AML.M0003 - Predictive AI Model Hardening: Use adversarial training and defensive distillation to increase jailbreak difficulty. 
  • AML.M0006 - Predictive AI Ensembles: Use multiple models so extracting one yields a less usable clone. 

  NIST AI 100-2e2025: Adversarial machine learning mitigations

  Mitigations in NIST’s “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations” (NIST AI 100-2e2025) also apply to malicious distillation, including differential privacy, pre- and post-training interventions, and prompt instruction/formatting.

  Differential privacy

  Differential Privacy (DP) provides mathematically rigorous protection against inference and distillation techniques by adding calibrated noise to model outputs and preventing malicious actors from extracting training data membership information and other sensitive model information, such as decision boundaries or signals that could help reconstruct private data. This protection is governed by privacy parameters that define a finite privacy budget, where each query consumes part of the model's available privacy protection and repeated querying steadily reduces the remaining privacy reserve. 

  As that budget is consumed through accumulated queries, the model must either add more noise to preserve privacy, restrict further queries, or accept reduced privacy protection. This creates a fundamental noise-versus-utility tradeoff, where stronger privacy protection requires more noise, which can lower prediction precision and business usefulness, while less noise improves utility but increases vulnerability to compromise techniques, such as membership inference, model extraction, or inversion. 

  In practice, the right balance requires careful tuning and empirical auditing, because theoretical privacy settings do not always predict real-world accuracy impact, particularly for complex models or high-dimensional outputs that require substantially more noise to achieve equivalent protection, or when facing adaptive actors. As a result, DP is often strengthened with complementary controls such as query rate limiting, response aggregation, and monitoring.

  Pre/post-training interventions

  A range of training strategies have been proposed to increase the difficulty of accessing harmful capabilities through prompt injection, including safety training during pre-training or post training, adversarial training methods, and other methods to make jailbreak techniques more difficult.

  Prompt instruction/formatting

  Model instructions can cue the model to treat user input carefully, such as by wrapping user input in XML tags, appending specific instructions to the prompt, or otherwise attempting to clearly separate instructions from user prompts to mitigate distillation and make prompt injection or jailbreaking less effective.

  Footnotes

  ¹ Publicly quoted training costs are from “DeepSeek-V3 Technical Report”

  ² MITRE is a registered trademark of The MITRE Corporation. MITRE ATLAS is a trademark of The MITRE Corporation.

  References

  • Anthropic: Detecting and preventing distillation attacks
  • Google: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use
  • NIST AI 100-2e2025: Adversarial Machine Learning A Taxonomy and Terminology of Attacks and Mitigations
  • OpenAI: RE: Updated Stakes for American-Led, Democratic AI
  • The Decoder: How China's gray market sells Claude tokens at a fraction of the price
  • White House National Security Presidential Memorandum 11 (NSPM-11): Artificial Intelligence in the National Security Enterprise
  • White House National Science and Technology Memorandum 4 (NSTM-4): Adversarial Distillation of American AI Models
  • White House Office of Science and Technology Policy post on X

  Disclaimer of endorsement

  The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

  Purpose

  This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

  Contact

  • National Security Agency
    Cybersecurity Report Feedback: CybersecurityReports@nsa.gov
    Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov
    Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov
  • Cybersecurity and Infrastructure Security Agency
    CISA’s 24/7 Operations Center (contact@cisa.dhs.gov), or by calling 1-844-Say-CISA (1-844-729-2472).
  • Federal Bureau of Investigation
    If you or someone you know has fallen victim to this campaign, file a complaint with IC3.
     

• A Tale of Two SOCs: Insights From Two Red Team Assessments

  Advisory at a Glance

  Title	A Tale of Two SOCs: Insights From Two Red Team Assessments
  Original Publication	August 25, 2026
  Executive Summary	The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A failed to detect or contain the activity, but Organization B rapidly identified initial compromise attempts, isolated affected systems, and forced the red team into an assume breach model. This advisory details the red team’s activity and organizations’ defensive actions, offering lessons learned and mitigations to help critical infrastructure organizations strengthen detection, response, and protections in IT, cloud, and operational technology (OT) environments.
  Lessons Learned	Untuned detection tools lead to missed threats. Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm network defenders. Organizational silos and bureaucratic hurdles prevent effective incident response. Detection tools are only as effective as the people, processes, and procedures supporting them; fragmented communication, unclear responsibilities, and limited defender authority hinder effective incident response. Cloud environments are often an underestimated risk. Organizations often lack security controls for cloud environments and processes for responding to a cloud compromise.
  Key Actions	Establish and continuously maintain a baseline and reduce alert noise by fine tuning. Break down silos and empower network defenders. Implement Conditional Access policies for workload identities and monitor for excessive or unused permissions. Establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.
  Intended Audience	Organizations: Federal Civilian Executive Branch agencies; state, local, tribal, and territorial governments; critical infrastructure. Roles: System administrators, incident responders, defensive cybersecurity analysts, vulnerability analysts, network operators, security systems managers, and all network defenders.

  Introduction

  The Cybersecurity and Infrastructure Security Agency’s (CISA’s) red team simulates real‑world malicious cyber operations to assess an organization’s ability to detect, investigate, and respond to malicious cyber activity. Emulating cyber threat actor tradecraft, the red team attempts to gain and maintain persistent access to an organization’s network and sensitive business systems (SBSs) while avoiding detection.

  CISA conducted two simultaneous red team assessments using similar tradecraft but observed different defensive responses. In one organization (Organization A), the team gained initial access to multiple workstations, gained elevated privileges over the domain, and moved laterally to SBSs and cloud resources undetected. In the second organization (Organization B), network defenders quickly detected the initial compromise and quarantined the affected systems.

  Because Organization B detected the initial compromise, the red team moved to an assume breach model, where Organization B trusted agents (TAs) provided access to a host that replicated the level of access the red team would have had if defenders had not detected their activity. From there, the red team escalated privileges and moved laterally to SBSs, cloud resources, and a bastion host in the OT demilitarized zone (DMZ), where defenders again detected activity and isolated the system.

  In coordination with the assessed organizations, CISA is releasing this Cybersecurity Advisory to describe the red team’s activity and the organization’s defensive responses and to share lessons learned that critical infrastructure organizations can use to strengthen their IT, cloud, and OT cybersecurity posture.

  CISA encourages critical infrastructure organizations to implement the recommendations in the Mitigationssection of this advisory to reduce the likelihood and impact of malicious cyber incidents.

  Download the PDF version of this report:

  A Tale of Two SOCs: Insights From Two Red Team Assessments (PDF, 937.09 KB )

  Technical Details

  Note: This advisory uses the MITRE ATT&CK^® Matrix for Enterprise framework, version 19. See the MITRE ATT&CK Tactics and Techniques section of this advisory for a table of the red team’s activity mapped to MITRE ATT&CK tactics and techniques.

  Overview

  CISA is authorized—upon request—to provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and to provide operational and timely technical assistance to federal and non-federal entities, with respect to cybersecurity risks (see generally 6 U.S.C. §§ 652[c][5], 659[c][6]). CISA conducted two concurrent red team assessments: one at a Government Services and Facilities Sector organization (Organization A), and one at a Water and Wastewater Systems Sector organization (Organization B).

  During CISA’s red team assessments, the red team simulates malicious cyber operations to assess an organization’s threat detection and response capabilities. The red team attempts to gain and maintain persistent access to an organization’s enterprise network, avoid detection, evade defenses, and access SBSs (applications, data stores, or infrastructure components where compromise would materially impact the organization's operations, finances, or customer data) selected by the organization. For the assessments described in this advisory, the team also attempted to gain access to cloud resources and to demonstrate their ability to access Organization B’s OT systems without actually doing so.

  Organization A

  Red Team Cyber Threat Activity

  Initial Access and Active Directory Discovery

  During reconnaissance, CISA’s red team identified a web application with default credentials [T1589.001] for multiple built-in user accounts that allowed the team to send emails from an internal email address. The team used the internal email address to send phishing emails [T1566] and gained initial access to four workstations.

  From the workstations, the red team leveraged a modified BloodHound¹ collector, customized to avoid static endpoint detection and response (EDR) signatures, to query and scrape Active Directory (AD) information. This information included AD users [T1087.002], computers [T1018], groups [T1069.002], access control lists, organizational units, and group policy objects (GPOs) [T1615]. The team found that one compromised workstation had the default Machine Account Quota (MAQ) of 10, allowing unprivileged users to add up to 10 computer accounts to the domain.

  The red team also queried the organization’s Active Directory Certificate Service (ADCS) certificate templates. Misconfigured ADCS templates are common and can allow low-privileged accounts to request a certificate on behalf of other users and computers, including highly privileged accounts. The team identified multiple templates with an ESC1 misconfiguration, which allows any user to request certificates for all users and computer accounts (see scenario ESC1 in SpecterOp’s Certified Pre-Owned: Abusing Active Directory Certificate Services). The red team exploited the misconfigured MAQ to create a machine account [T1136.002] and then exploited a misconfigured ADCS template to request a certificate for the newly created machine account [T1649]. They could then obtain certificates for any user account, providing means for lateral movement.

  Post Exploitation: Privilege Escalation and Lateral Movement

  Sensitive Business Systems

  After the red team gained elevated privileges over the domain, they began post-exploitation activities and attempted to access SBSs. To access the SBSs, the team needed to identify their network location and security controls.

  The team’s plan to achieve SBS access included the following steps:

  1. Use previously acquired AD data to identify users and groups related to the SBS.
  2. Query system center configuration manager (SCCM) servers to enumerate user-device relationships and identify the workstations assigned to each user [T1033].
  3. Move laterally from the SCCM server to the target users’ workstations.
  4. Find credential material on the target user’s workstation to access the SBS.
  5. Verify administrative access to the SBS would allow compromise of the availability, integrity, and/or confidentiality of the system and its data.

  For each SBS, the red team used similar discovery and initial access techniques but unique credential retrieval methods. For SBS 1, a database, the team located cleartext credentials on an administrative user’s workstation providing access to the system [T1552]. For SBS 2, also a database, the red team searched the targeted user’s workstations for connections.json and product-preferences.xml files for a Structured Query Language (SQL) developer tool. The team decrypted these files to obtain the cleartext password to the database [T1552.001]. For SBS 3, an automated processing system, the red team acquired long-lived static Amazon Web Service (AWS) identity and access management (IAM) user credentials saved in configuration files in targeted users’ home directories. These credentials do not expire because the organization had not configured credential expiration or rotation.

  For SBS 2 and 3, the red team expanded access beyond users’ physical workstations to include their virtual desktops, which limited their access to the active, interactive sessions held by users. While virtual workstations add security controls, such as segmenting networks of sensitive systems to only allow virtual hosts, they are generally synchronized with a root drive of the distributed file system (DFS). The red team compromised the root DFS drive, granting them access to local files of all users’ virtual desktops, regardless of the existence of an active session. This allowed the team to quickly search for cloud configuration files containing credentials and database connection files for thousands of users.

  The red team obtained administrative access to all targeted SBSs without defensive intervention by proxying tools [T1090.001] through compromised workstations and using the collected credentials.

  Microsoft Entra Systems

  After compromising the target SBSs, the red team attempted to compromise Organization A’s Microsoft cloud environment by compromising Organization A’s Microsoft Entra ID (formerly Azure AD) through applications. The team targeted Entra ID applications with Application permissions, which allow applications to access data without user consent (compared to Delegated permissions, which allow applications to access data with user consent). By compromising an application that had elevated Application permissions, the red team would gain the same permissions as the application because these applications operate outside the scope of traditional conditional access policies (CAPs) that provide controls for user access and activity.

  Note: Microsoft’s Conditional Access for workload identities extends traditional CAPs to service principals (SPs) used by applications and governs Application permissions by allowing organizations to broadly apply access policies to applications. Implementing Conditional Access for workload identities would have protected against red team exploiting use of Application permissions; however, the red team never observed an organization using Conditional Access for workload identities.

  The team compromised applications and used their permissions by:

  1. Enumerating the organization’s cloud resources using the publicly available tools, including AzureHound² and ROADrecon,³ to gather information about applications, their permissions, and their owners [T1526] [T1588.002].
  2. Identifying applications with elevated permissions to the Microsoft Graph Resource application programming interface (API), including the following:
     
     1. Mail.Read – Read Outlook emails.
     2. Mail.ReadWrite – Read and write Outlook emails.
     3. Chat.Read.All – Access Teams messages.
     4. Files.Read.All – Access OneDrive.
     5. Application.ReadWrite.All – Add Client Secrets to any application or SP.
     6. AppRoleAssignment.ReadWrite.All – Lets an SP grant itself powerful Graph application permissions such as Chat.Read.All or RoleManagement.ReadWrite.Directory.
  3. Identifying the owner of an application with Mail.ReadWrite permissions.
  4. Moving laterally to the owner’s machine.
  5. Obtaining access to the user’s primary refresh token (PRT).
     
     1. A PRT is a secure artifact specifically issued to Microsoft first-party token brokers to enable single sign-on (SSO) across the applications used on those devices. For more information about PRT, see Microsoft’s Understanding Primary Refresh Token (PRT) in Microsoft Entra ID.
  6. Using the PRT to request access and refresh tokens for the targeted application’s owner.
     
     1. Access tokens are short-lived tokens issued by Entra ID that grant a client permission to access specific resources or APIs on behalf of a user.
     2. Refresh tokens are longer-lived tokens issued by Entra ID that allow a client to silently request new access tokens without requiring the user to sign in again.
  7. Using the access token to add a new client secret to the target application.
     
     1. A client secret is a confidential string used by the application to authenticate itself to Entra ID during token requests.
  8. Using the new client secret to request a new access token for the target application.
  9. Impersonating the application by using the access token [T1550.001] to retrieve and review target emails [T1114] via the Microsoft Graph API.

  This allowed the red team to review security operations center (SOC) staff emails to see if SOC staff were aware of the compromise.

  Organization A’s Response

  The organization did not respond effectively to red team activity. The red team observed this during their engagement by accessing SOC personnel emails and moving laterally to SOC workstations where they captured screenshots [T1113], used keyloggers [T1056.001], and retrieved Microsoft Teams messages [T1213.005].

  The red team observed that the SOC received medium- and low-severity EDR alerts related to the red team activity but did not respond to them. Thousands of false positive alerts corresponding to normal business operations, many with a higher severity, obscured the alerts triggered by red team activity.

  Organizational silos further hindered detection and response. The organization had multiple SOCs and multiple EDR solutions. Staff did not communicate with staff from other SOCs or have visibility on their detection tools. SOC staff and system owners also did not communicate with each other.

  This led to SOC staff not actioning alerts from red team activity. For example, red team members noted chat exchanges regarding an SCCM in which defenders tried and failed to identify the system owner, its function, and its typical use. The SOC team eventually flagged the alert as a false positive.

  The red team believes this was because the SOC staff lacked standard operating procedures for escalating alerts and had limited personnel authority.

  Organization B

  Red Team Cyber Threat Activity

  Initial Access

  The CISA red team gained initial access to Organization B’s environment through a spearphishing campaign. The team gathered email addresses from public websites [T1589.002] and sent phishing emails that eventually led to three users clicking [T1204] on a malicious link, giving the red team access to three workstations.

  Each payload execution generated a medium-severity alert: “An executable file loaded an unexpected DLL file.” SOC staff triaged these alerts and manually isolated all three workstations within 10, 2, and 20 minutes. This effectively terminated the team’s command and control (C2) communications with the workstations. Before staff isolated one workstation, the red team enumerated Organization B’s domain’s AD structure by executing various Lightweight Directory Access Protocol (LDAP) queries through the callback. The data gathered included all users, groups, computers, domains, GPO, and subsequent relationships for the entire domain.

  Because the defenders removed their initial foothold, the red team switched to an assume breach model. Organization B’s TAs (organization IT staff who knew of the assessment and were in contact with the red team) executed a red-team-provided payload on a designated internal host. This host was associated with a standard user account with no administrative privileges, replicating the same level of access the red team would have maintained if Organization B’s defenders had not detected them.

  Domain Compromise

  With persistent access to the internal network, the red team searched for ways to escalate their privileges over the domain to facilitate lateral movement and access SBSs. The red team used the assume breach account to query the MAQ attribute of Organization B’s domain and discovered that all domain users were able to add accounts to the domain.

  The red team created a new machine account with a hostname designed to resemble a legitimate host. The creation of the machine account provided the red team with a domain account and a password that they controlled. This allowed them to execute standalone tools from a red-team-controlled Linux workstation. The tool’s traffic was proxied through the assume breach host, circumventing restrictions imposed by host-based EDR.

  The red team did not identify any escalation paths from the AD data; however, enumeration of SCCM distribution points led to the discovery of an XML file with cleartext credentials for a domain service account. AD data showed that the newly acquired service account had outbound object control over almost 1,000 accounts within the domain due to its group membership. Most notably, the service account had AllExtendedRights permission over a domain controller, which enabled the team to conduct a resource-based constrained delegation attack, granting them DCSync privileges [T1003.006] and the ability to obtain AD account credentials. The team used these credentials throughout the remainder of their assessment to access servers and workstations. One of the first accounts the red team DCSynced was the krbtgt account, which a malicious cyber actor could use to forge Golden Tickets that allow for impersonation of any user in Organization B’s domain.

  Post Exploitation

  Sensitive Business Systems

  The TAs provided the names of two SBSs, one of which the red team successfully compromised. To do this, the team reviewed previously collected BloodHound data and identified a user account with access to an SBS web server that allowed Kerberos authentication. Because the red team had already compromised the on-premises (on-prem) AD environment, they could impersonate this user to access the server.

  The team:

  1. Used DCSync to acquire the user’s AES256 password hash.
  2. Used the password hash to request a Kerberos ticket-granting ticket (TGT) for the user.
  3. Used the TGT to request a Kerberos service ticket [T1558] for the web server’s service principal name (SPN).

  After requesting the Kerberos service ticket, the red team imported it into a Windows virtual machine (VM) on their infrastructure. The red team configured their VM to proxy any traffic to Organization B’s network through a SOCKS proxy that tunneled traffic through a compromised host.

  Operational Technology Network

  The red team wanted to gain visibility of the OT network and identify OT network subnets. To do this, they first identified an IT workstation with Remote Desktop Protocol (RDP) files, including a file named ics-[redacted]-org, signifying that the user likely had remote access to the OT network. The red team identified that the workstation had remote access to a bastion host. A bastion host—sometimes referred to as a jump box or jump server—is a specialized, highly secured system (often a server or dedicated workstation) that serves as the sole access point between a network segment (such as an internal IT network) and a protected internal network (like an OT environment).

  The red team gained access to this bastion host using File Transfer Protocol (FTP) credentials to log in over Secure Shell (SSH) [T1021.004]. At this point, they had visibility over the OT network.

  They attempted to gain a C2 session on the server by dropping several payload files on the host and executing them. However, the callback never reached red team infrastructure because the host blocked outbound internet connections. The payload execution triggered an alert that led SOC staff to quarantine the host.

  Microsoft Entra Systems

  The red team attempted to access Organization B’s cloud-based Entra ID infrastructure to find a way to move from on-prem AD to the cloud. Organization B had a hybrid environment, and user credentials automatically synchronized between on-prem AD and cloud Entra ID. Given this, the red team looked for the on-prem server responsible for synchronization.

  Entra ID Connect (formerly Azure AD Connect) sets up an on-prem account with the prefix MSOL_ to synchronize credentials with Entra ID. The red team used the open source tool ADConnectDump⁴  to obtain cleartext credentials for the on-prem Microsoft Online (MSOL) account and the Entra ID account Sync_[redacted] [T1003]. With cleartext credentials for Sync_[redacted], the red team logged into the Azure portal. Sync_[redacted] was not intended for interactive logins and, in this case, did not have multifactor authentication (MFA) enabled. However, the red team used this account to obtain access tokens for use with AzureHound and ROADrecon to gather Entra ID data for Organization B’s tenant.

  Note: The red team obtained cleartext MSOL credentials and logged into the Azure portal because MSOL accounts used to have a large number of permissions; Microsoft has since removed these permissions. See Microsoft’s Action required: MSOnline and AzureAD PowerShell retirement - 2025 info and resources and Important update: Deprecation of Azure AD PowerShell and MSOnline PowerShell modules for more information.

  The interactive login from Sync_[redacted] triggered an automated alert from Microsoft, which sent the information to Organization B’s SOC staff, who then blocked the suspicious activity.

  The red team identified a computer account containing AZURESSO in its name, located in the on-prem AD environment. This account is part of the Seamless SSO implementation and allows users to use Kerberos tickets as the first step in authenticating to Entra ID. To abuse Seamless SSO, the red team acquired encrypted credentials of a target user via DCSync and then used the Rubeus “asktgs” module to request service tickets used for SSO. The red team imported the service tickets to their workstation and proxied their traffic through Organization B’s network using a SOCKS proxy. This allowed them to browse to https://portal[.]azure[.]com, while using legitimate Kerberos tickets, and the traffic appeared to originate from a trusted IP address.

  This approach allowed the red team to gain access to Entra ID as any user synced to AD without the user’s cleartext password. However, they could only use Kerberos tickets for the first phase of the sign-in process. If a user was set up to use MFA, then Entra ID would prompt the red team for a second factor during the sign-in process. Therefore, the red team was only able to log into any Entra ID account that did not have MFA enabled, which seemed limited to service accounts. They reviewed the previously obtained Entra ID data and looked for applications that had excessive permissions and were accessible to AD-synced service accounts.

  The red team identified an application that had permission to read, write, and send emails for all users within Organization B’s tenant. The application was owned by an AD-Synced account that was disabled in AD. Using a compromised host in the on-prem environment, they re-enabled this account, DCSynced its credentials, and used the AES256 hash to request Kerberos tickets. The red team used the tickets to authenticate to Entra ID and were then able to add a client secret to the application. This gave them the ability to retrieve the emails of every user within Organization B’s environment from the public internet.

  Organization B’s Response

  Organization B quickly triaged and responded to alerts after the red team gained initial access, effectively terminating the team’s C2 communications with the workstations and leading the red team to move to an assume breach model. These actions demonstrated a mature, proactive security posture and helped prevent wider compromise.

  When the red team gained access to a bastion host in the OT DMZ, Organization B had defensive controls that blocked outbound connections to red team infrastructure, and SOC staff quickly triaged and responded to an alert by isolating the host.

  When the red team logged into the organization’s Azure portal via a compromised account, it triggered an automated alert from Microsoft, which led the staff to block the suspicious account. In addition, Organization B had custom detections Entra ID Risky User Alerts for “Unfamiliar sign-in properties” and “Suspicious API traffic” that alerted to the AzureHound user agent and to accounts exceeding predefined request thresholds to the Microsoft Graph API.

  See Table 1 for Organization B’s defensive measures and associated response.

  Table 1. Red Team Activity and Organization B SOC Response

  Red Team Activity	Defensive Measure	SOC Response	Outcome
  C2 payload executed on a workstation.	Payload execution generated a medium-severity alert.	Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online.	Red team lost access to a workstation.
  C2 payload executed on a second workstation.	Payload execution generated a medium-severity alert.	Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online.	Red team lost access to a workstation.
  C2 payload executed on a third workstation.	Payload execution generated a medium-severity alert.	Staff quarantined workstation; staff analyzed and reimaged before putting workstation back online.	Red team lost access to a workstation.
  C2 payload executed on bastion host in the OT DMZ.	Payload execution generated alerts.	Staff quarantined the host.	Red team lost access to the host.
  Used compromised Entra ID account to log into Azure.	Automated alert from Microsoft.	Staff blocked the account.	Red team compromised a different account and accessed Entra ID by abusing Seamless SSO.

  Despite these strengths, Organization B had areas for improvement. The red team was eventually able to access Entra ID through a computer account that was part of the organization’s Seamless SSO implementation. The account did not have MFA and had overly permissive application permissions, indicating the need for more mature cloud security processes.

  Additionally, Organization B had excessive permissions and misconfigurations in AD and service accounts, which the red team leveraged for privilege escalation. This highlights the importance of regular audits and strict enforcement of least privilege principles. Organization B could improve credential hygiene, as the red team found credentials for OT systems stored in plaintext on jump servers. Finally, while segmentation and egress controls were effective, ongoing review and tightening of IT/OT connectivity and access architectures would reduce opportunities for lateral movement.

  Lessons Learned

  The red team identified lessons learned based on each organization’s response. Organization A and Organization B contrasted significantly in their ability to quickly identify and respond to red team activity. However, similar gaps in both organizations contributed to the red team’s compromise of their cloud systems.

  Untuned Detection Tools Lead to Missed Threats

  Organization A did not tune their detection tools to reduce alert noise, leading to an unmanageable level of alerts for SOC staff to review and action. The same red team activity that triggered alerts and action for Organization B led to no response for Organization A because SOC staff did not identify the activity as potentially malicious amid the overwhelming volume of alerts. Organization B had an established baseline and a fine-tuned alert system, allowing defenders to effectively filter out routine business activity and false positives. As a result, anomalies stood out, enabling the SOC staff to quickly detect and respond to red team activity.

  Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm defenders, obscuring real threats. Organizations that tune alerts to highlight anomalies and filter out normal business activity enable defenders to focus on genuine incidents and respond rapidly.

  Organizational Silos and Bureaucratic Hurdles Prevent Effective Incident Response

  In Organization A, lack of communication and visibility created by organizational silos (among multiple SOCs and between SOC staff and system owners) hindered effective incident response, resulting in missed opportunities for identification of a major breach.

  Bureaucratic barriers arose because SOC staff managed systems without understanding their authorities as responsibilities and authorities varied across network segments. They had no escalation procedures and so defaulted to a “wait and see” approach.

  In contrast, Organization B empowered its defenders to act decisively. Staff quickly triaged alerts, investigated root causes, identified misconfigurations, and coordinated remediation with engineering.

  Detection tools are only as effective as the people, processes, and procedures supporting them. SOC staff should not operate in silos and should have clear authority unhindered by bureaucracy to effectively contain and resolve incidents.

  Organizations Underestimate Risks in Cloud Environments

  Both organizations underestimated the risks associated with cloud environments. They granted excessive permissions to cloud applications, allowing the red team to access cloud systems. They also lacked fully mature, defined processes for detecting and remediating compromise of cloud environments, allowing the red team to maintain access to cloud resources.

  Use of Long-Lived User Identity and Access Management Credentials

  Organization A used long-lived static IAM user credentials that were set to never expire. If a malicious actor obtains them, they will have all the user permissions, potentially enabling persistent, unrestricted access to the cloud environment.

  Excessive Permissions

  Both organizations lacked Conditional Access for workload identities. This feature extends Conditional Access beyond user accounts, covering non-human identities, such as applications. It allows organizations to broadly apply access policies to applications that control how and when the application is used to access resources. Instead, both organizations used broad application permissions for most apps, which the team was able to exploit for access to the environment. In both organizations, the team was able to exploit excessive permissions to read emails.

  Lack of Mature Remediation Processes for Tokens

  Both organizations lacked processes for revoking compromised access/refresh tokens. Without a well-defined, efficient process for remediating and revoking access/refresh tokens following a cloud compromise, malicious cyber actors evicted from on-prem environments may still leverage cloud access to regain entry. Organizations should establish mature procedures to detect and remediate compromises of cloud environments to prevent malicious cyber actors from reestablishing access.

  Issues

  The red team identified the following issues that contributed to their ability to maintain persistent access to Organization A and/or B and escalate privileges or move laterally:

  • Misconfigured ADCS templates.
    
    • In Organization A, the red team identified and exploited a certificate template with common template misconfiguration known as ESC1, an overly permissive certificate template where the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag is enabled and low-privileged users can request certificates. This allows malicious actors to impersonate users. See SpecterOp’s Certified Pre-Owned: Abusing Active Directory Certificate Services for information about the ESC1 misconfiguration.
  • Workstations where MAQ was misconfigured.
    
    • In Organization A, the team gained access to a workstation where the MAQ was set to the default value of 10. This meant that unprivileged users could add up to 10 computer accounts to the domain.
    • In Organization B, the MAQ was set to 1,000 for all domain users, allowing any user to create a large number of machine accounts.
  • Service accounts with excessive permissions.
    
    • In Organization B, the red team identified a domain service account with AllExtendedRights permission over a domain controller. AllExtendedRights enables malicious cyber actors to perform DCsync attacks and potentially impersonate any account in the domain, leading to full domain compromise.
  • Cleartext credentials.
    
    • In Organization A, the red team found and used cleartext credentials to obtain administrative access to SBSs.
    • In Organization B, the red team identified a cleartext password in an XML file for a domain service account.
  • Endpoint management systems that lacked additional security controls.
    
    • In Organization A, the red team moved laterally from the SCCM server to users’ workstations. SCCM and other endpoint configuration managers (e.g., Jamf, BigFix) have broad administrative reach and are Tier 0 assets. If compromised, Tier 0 assets provide malicious actors with powerful escalation paths and control over the enterprise.

  The red team identified an additional issue that was not exploited during the assessment but could be exploited by malicious cyber actors:

  • AD misconfigurations and user accounts with excessive permissions.
    
    • In Organization B, the red team discovered that standard user accounts were improperly assigned to privileged administrative groups within the AD.

  MITREATT&CK Tactics and Techniques

  See Table 2 to Table 11 for all referenced threat actor tactics and techniques in this advisory.  For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool.

  Table 2. Reconnaissance

  Technique Title	ID	Use
  Gather Victim Identity Information: Credentials	T1589.001	The red team performed reconnaissance and identified a web application with default credentials.
  Gather Victim Identity Information: Email Addresses	T1589.002	The red team performed reconnaissance and gathered employee email addresses from public websites.

  Table 3. Resource Development

  Technique Title	ID	Use
  Obtain Capabilities: Tool	T1588.002	The red team used publicly available tools, including AzureHound and ROADrecon.

  Table 4. Initial Access

  Technique Title	ID	Use
  Phishing	T1566	The red team gained initial access to four Organization A workstations by sending phishing emails from an internal email address. The red team gained initial access to three Organization B workstations via spearphishing emails that eventually led users to click on a malicious payload.

  Table 5. Execution

  Technique Title	ID	Use
  User Execution	T1204	The red team’s spearphishing emails eventually led to users clicking on a malicious payload.

  Table 6. Persistence

  Technique Title	ID	Use
  Create Account: Domain Account	T1136.002	The red team exploited misconfigured MAQs to create machine accounts on a workstation.

  Table 7. Credential Access

  Technique Title	ID	Use
  Unsecured Credentials	T1552	The red team located cleartext credentials on an administrative user’s workstation. The red team used the open source tool ADConnectDump to obtain cleartext credentials for cloud accounts.
  Unsecured Credentials: Credentials In Files	T1552.001	The red team searched a targeted user’s workstations for connections.json and product-preferences.xml files for a SQL Developer tool. They then decrypted these files to obtain cleartext password to the database. The red team acquired long-lived static AWS IAM user credentials in configuration files in users’ home directories.
  OS Credential Dumping	T1003	The red team obtained cleartext credentials for an on-prem MSOL account and Entra account.
  OS Credential Dumping: DCSync	T1003.006	The red team used DCSync to obtain AD account credentials.
  Steal or Forge Authentication Certificates	T1649	The red team could obtain certificates for any Organization A user account. This provided the means for lateral movement.
  Steal or Forge Kerberos Tickets	T1558	The red team used a Kerberos TGT to request a Kerberos service ticket for a web server’s SPN. The red team used the Rubeus “asktgs” module to request service tickets used for SSO.

  Table 8. Discovery

  Technique Title	ID	Use
  Account Discovery: Domain Account	T1087.002	The red team used a BloodHound collector to query and scrape AD information, including AD users.
  Remote System Discovery	T1018	The red team used a BloodHound collector to query and scrape AD information, including computers.
  Permission Groups Discovery: Domain Groups	T1069.002	The red team used a BloodHound collector to query and scrape AD information, including groups.
  Group Policy Discovery	T1615	The red team used a BloodHound collector to query and scrape AD information, including GPOs.
  System Owner/User Discovery	T1033	The red team queried SCCM servers to enumerate user-device relationships and identify the workstations assigned to users.
  Cloud Service Discovery	T1526	The red team used publicly available tools to obtain a list of Entra applications, their permissions, and their owners.

  Table 9. Lateral Movement

  Technique Title	ID	Use
  Use Alternate Authentication Material: Application Access Token	T1550.001	The red team used an application access token to access and review cloud emails.
  Remote Services: SSH	T1021.004	The red team used FTP credentials to log into a bastion host over SSH.

  Table 10. Collection

  Technique Title	ID	Use
  Email Collection	T1114	The red team reviewed Organization A SOC staff cloud emails to see if SOC staff were aware of the compromise. The red team had the ability to retrieve the emails of every user within Organization B’s environment from the public internet.
  Screen Capture	T1113	The red team took screenshots of SOC staff workstations.
  Input Capture: Keylogging	T1056.001	The red team used keyloggers on SOC staff workstations.
  Data from Information Repositories: Messaging Applications	T1213.005	The red team pulled Microsoft Teams messages from SOC staff workstations.

  Table 11. Command and Control

  Technique Title	ID	Use
  Proxy: Internal Proxy	T1090.001	The red team proxied through compromised workstations.

  Mitigations

  CISA recommends that organizations implement the mitigations below to strengthen their cybersecurity posture based on the Lessons Learned and identified Issues. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

  Establish Baselines and Improve Monitoring

  • Establish and continuously maintain a baseline of installed tools and software, account behavior, and network traffic.
  • Reduce alert noise by refining monitoring tools and alerting mechanisms to differentiate between typical administrative actions and potential threat behavior.
    
    • For information on establishing a baseline and reducing alert noise, see CISA’s joint Guidance Identifying and Mitigating Living Off the Land Techniques.

  Eliminate Silos and Bureaucratic Hurdles

  • Break down silos by encouraging regular communication and collaboration between IT, security, and business units.
    
    • Consider using joint exercises, shared tools, and creating cross-functional teams.
    • Integrate detection with incident response workflows to enable rapid containment and remediation.
  • Empower network defenders.
    
    • Develop and communicate policies [CPG 1.A, CPG 1.B] that support rapid, coordinated response and clarify when defenders can act independently versus when escalation is required.
      
      • Define clear roles and responsibilities so defenders know their authorities and escalation paths (if needed) during incidents.
      • Grant defenders the authority to take necessary actions (e.g., isolating systems, blocking traffic) without excessive approvals.
    • Conduct training and simulated incident response exercises to reinforce roles, improve coordination, and identify gaps in authorities or communication [CPG 6.A].

  Enhance Cloud Security Controls

  Note: While both organizations used Microsoft Entra ID and Organization B also used AWS, many of the techniques used by the red team are applicable across identity providers and cloud environments and not necessarily unique to Microsoft and AWS. CISA encourages all organizations using cloud environments to implement the recommendations below.

  • Secure and monitor access/refresh tokens and establish and regularly review comprehensive procedures for detecting, remediating, and revoking access/refresh tokens in the event of a cloud compromise.
    
    • Implement automated token revocation and access reviews and conduct periodic incident response exercises to validate the effectiveness of these processes.
    • Restrict access based on trusted network locations, device compliance, and risk signals (such as unusual activity or sign-in patterns).
    • Monitor sign-in logs and policy evaluation results for workload identities to detect suspicious activity.
    • Regularly check application permissions; make a risk-informed decision to identify and remove any that are not necessary, so each application only has the access it needs to function.
    • Regularly audit SP credentials and rotate secrets or certificates to reduce exposure.
  • Identify and disable legacy accounts.
  • Enable phishing-resistant MFA for all user, administrative, and privileged accounts in cloud platforms [CPG 3.F].
  • Protect keys and secrets by storing them securely and enforcing mandatory rotation schedules; apply cryptographic boundary controls to internal and third-party credentials.
  • Set up automated alerts for suspicious cloud application activity, such as abnormal API calls, and credential activity, such as login attempts from unusual locations.
  • Leverage user and entity behavior analytics to analyze and correlate activities across multiple data sources and identify unusual credential or token usage.
  • Continuously audit authentication and access logs for signs of replay or unauthorized access.
  • Implement just-in-time (JIT) access for privileged accounts, replacing standing administrative rights with temporary, time-bound privilege elevations.

  For organizations using Entra ID:

  • Monitor and control who has access to application identities.
    
    • Implement CAPs for workload identities and monitor for excessive or unused permissions.
    • Use Microsoft’s app governance to detect and manage risky SPs, which are special accounts used by applications and services. See Microsoft’s OAuth app visibility and insights with app governance - Microsoft Defender for Cloud Apps for more information.
  • Integrate Entra ID tenant monitoring with on-prem security operations to promptly identify suspicious activity.
  • Regularly review and restrict application permissions (e.g., Mail.Read, Files.Read.All).
    
    • For guidance, see CISA’s Secure Cloud Business Applications (SCuBA) Project, which provides secure configuration baselines for Microsoft 365 (M365), including Microsoft Entra ID.
    • Use CISA’s ScubaGear, a no-cost assessment tool that verifies M365 tenant configuration alignment to the policies described in SCuBA’s secure configuration baselines.
  • Use certificate-based authentication certificates for application authentication instead of client secrets, when possible. See Microsoft’s Set Up Microsoft Entra CBA - Microsoft Entra ID.
  • Review newly created secrets and/or certificates on existing applications.
  • Limit secret lifetimes to a reasonable lifetime.

  In AWS environments:

  • Mitigate the risks of long-lived IAM user credentials.
    
    • Identify and audit all existing access keys and disable/delete unused or unnecessary keys.
  • Require human users to use temporary AWS credentials through SSO.
    
    • Users will assume an IAM role for AWS access and receive temporary credentials that expire within an hour.
    • For more information on accessing AWS using temporary credentials, see Amazon’s documentation Security best practices in IAM and Compare IAM identities and credentials.
  • Regularly review the environment to verify no long-lived credentials remain.

  Secure Active Directory and Manage Credentials

  • Apply secure configurations to ADCS implementations.
    
    • Disable the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag from templates to prevent users from supplying and editing sensitive security settings within these templates.
    • Restrict accounts that can enroll in all certificate templates to only those necessary, especially templates with the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag.
    • Remove FullControl, WriteDacl, and Write property permissions from low-privileged groups, such as domain users, to certificate template objects, where such permissions are not needed.
    • Enforce manager approval for requested certificates.
    • Apply additional guidance from CISA’s joint Guidance Detecting and Mitigating Active Directory Compromises (see Mitigating AD CS compromise, pages 15–16).
  • Configure the MAQ to zero unless there is a specific operational need for non-administrative users to create computer accounts; this prevents standard user accounts from creating new machine accounts, reducing opportunities for malicious cyber actors to abuse this privilege.
    
    • If some standard user accounts need to create computer accounts, set MAQ to the lowest possible value and restrict this capability to only users or groups with a business justification.
  • Improve credential hygiene.
    
    • Scan network shares and workstations for plaintext credentials and remove any found.
    • Train staff on secure password storage practices and enforce policies prohibiting plaintext password storage.
    • Use encrypted password vaults for storing credentials and limit access to only those who require it.
    • Periodically audit credential stores and access logs for signs of misuse.
  • Periodically audit AD permissions for misconfigurations and excessively privileged groups and accounts.
    
    • Implement the principle of least privilege [CPG 3.H].
    • Grant standard user rights for standard user tasks such as email, web browsing, and using line-of-business applications.
    • Periodically audit standard user accounts and minimize privileged access.
    • Periodically audit AD permissions to verify that standard user accounts do not have excessive permissions and have not been added to admin groups.
    • Evaluate which administrative groups should administer specific servers and workstations.
    • Separate administrator accounts from standard user accounts [CPG 3.G].
      
      • Use designated workstations for administrators and standard users and prevent administrators from using admin workstations for non-admin purposes; this would reduce impact of credential theft from a user workstation.
      • Use designated administrative accounts exclusively for admin purposes.
      • If a standard user account needs administrative rights over their workstation, use a separate account that does not have administrative access to other hosts, such as servers.
    • Consider using a privileged access management (PAM) solution to manage access to privileged accounts and resources.
      
      • PAM solutions can log and alert usage to detect unusual activity, which could have alerted the assessed organizations when the red team accessed resources with admin accounts.
      • Note: Treat password vaults associated with PAM solutions as high value assets (HVAs) with additional restrictions and monitoring.
    • Configure time-based access for accounts set at the admin level and higher.
      
      • The just-in-time access method provisions privileged access when needed and can support enforcement of the principle of least privilege, as well as the zero trust model. A network-wide policy automatically disables administrator accounts at the AD level when the account is not needed. When standard user accounts need administrative access, they submit their requests through an automated process that enables access to a system, but only for a set timeframe to support task completion.

  Secure Endpoint Configuration Managers

  • Treat endpoint management systems (such as SCCM) as HVAs with additional restrictions and monitoring because they provide elevated access to thousands of hosts.

  Segment Operational Technology Networks

  • Implement strict firewall rules and access controls between IT and OT environments [CPG 3.I].
  • Limit jump server access to OT networks and require MFA for all connections.
  • Regularly review OT network architecture and access paths to minimize unnecessary connectivity.
  • Monitor OT network traffic for signs of lateral movement or unauthorized access.
  • Implement change management solutions to track and restrict modifications to OT components.

  Validate Security Controls

  In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK Matrix for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

  To get started:

  1. Select an ATT&CK technique described in this advisory (see Table 2 to Table 11).
  2. Align your security technologies against the technique.
  3. Test your technologies against the technique.
  4. Analyze your detection and prevention technologies’ performance.
  5. Repeat the process for all security technologies to obtain a set of comprehensive performance data.
  6. Tune your security program, including people, processes, and technologies, based on the data generated by this process.

  CISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

  Resources

  • Microsoft: Understanding primary refresh token (PRT)
  • SpecterOps: Certified pre-owned: Abusing Active Directory Certificate Services

  Contact Information

  Organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). When available, please include the following information regarding the incident:

  • Date, time, and location of the incident;
  • Type of activity;
  • Number of people affected;
  • Type of equipment used for the activity; and
  • Name of the submitting company or organization, and a designated point of contact.

  Disclaimer

  The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.

  Version History

  August 25, 2026: Initial version.

  Notes

  ¹ “SpecterOps / Bloodhound,” GitHub, last modified July 15, 2026, https://github.com/SpecterOps/BloodHound.

  ² “SpecterOps / AzureHound,” GitHub, last modified June 4, 2026, https://github.com/SpecterOps/AzureHound.

  ³ “ROADrecon,” GitHub, https://github.com/dirkjanm/ROADtools/tree/master/roadrecon.

  ⁴ “dirkjanm/adconnectdumb,” GitHub, last modified August 25, 2026, https://github.com/dirkjanm/adconnectdump.

• Defending Against an Active Threat to Siemens S7 Series PLCs

  Executive summary

  Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.

  Top Mitigations

  • Inventory all Siemens S7 Series programmable logic controllers (PLCs)
  • Apply critical security patches 
  • Ensure PLCs are not accessible from the Internet
  • Strengthen access controls
  • Monitor for unauthorized activity
  • Harden PLC services, protocols, and ladder logic integrity 
  • Hunt for anomalies that may indicate a compromise

  The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them. 

  The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems. 

  The authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems:

  • are properly protected with all applicable security patches and updates, 
  • are isolated from the Internet wherever possible, 
  • have strong access controls, and 
  • employ security tooling to monitor ICS environments for anomalous or malicious activity.

  These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.

  Technical details

  Note: This advisory uses the MITRE ATT&CK^® Matrix for ICS¹ framework, version 19, and the MITRE ATT&CK Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FEND^TM, version 1.5.0. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and MITRE D3FEND tactics, techniques, and countermeasures.

  Threat actor targeting

  Threat actors are actively targeting the following Siemens PLC models:

  • S7-200 Series (all CPU variants)
  • S7-300 Series (all CPU variants including 314, 315, 317 models)
  • S7-400 Series (all CPU variants)
  • S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
  • S7-1500 Series (all CPU variants, including F-series safety controllers)

  Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.

  Note: Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation. 

  Threat actors are leveraging open source industrial automation libraries—specifically snap7.dll/python-snap7—combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.

  Threat actor techniques

  Threat actors are:

  • Using Internet scanning services (e.g., Censys, ZoomEye) to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs [T1596.005]
  • Rapidly iterating exploit code through AI-assisted development, lowering technical barriers to ICS attacks [T1587.004, T1588.007]
  • Taking advantage of insecure credentials to access exposed devices that have unconfigured (default) or minimally configured authentication [T1694]
  • Deploying AI-generated Python scripts that incorporate the snap7.dll library from public repositories [T0834] to gain read/write access to the PLC and mimic legitimate tools
  • Masquerading malicious scripts as legitimate monitoring tools to evade detection by security teams [T0849]
  • Conducting read/write operations on data blocks, potentially for reconnaissance, capability testing, or pre-positioning for effects operations [T0893, T0821]

  The authoring agencies assess this activity pattern is likely intended as persistent reconnaissance in targeted sectors and facilities to develop capabilities and prepare to cause operational effects against critical infrastructure. For capability development, actors are testing and refining their exploitation techniques against specific PLC models to improve their ability to compromise the PLCs. To prepare for operational effects, actors are leveraging read access to understand target environments, enabling preparation and positioning for future write operations to cause disruption or other operational impacts.

  Potential operational impacts

  The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Additionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well. Unauthorized access to PLCs could result in:

  • Disruption of critical industrial processes affecting production throughput, product quality, and public services
  • Safety incidents affecting personnel through manipulation of safety interlocks, emergency shutdown systems, or process parameters
  • Equipment damage and extended operational downtime from process upsets, improper sequencing, or forced equipment operation outside design parameters
  • Compromise of sensitive operational data, including proprietary process recipes, control strategies, and facility configurations
  • Cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations
  • Regulatory compliance violations and potential liability from process safety management failures

  Mitigation actions

  Since threat actors are developing capabilities using AI to compromise PLCs using known vulnerabilities, misconfigurations, and other weaknesses and then may use compromised PLCs to interfere with normal operations, the authoring agencies urge organizations to implement comprehensive defense-in-depth strategies, in addition to Common Vulnerabilities and Exposures (CVE) remediation, to protect and defend their PLCs.

  Detection opportunities

  Organizations should implement detection strategies and hunt for anomalies that may indicate a compromise, focusing on [D3-PM]:

  • Anomalous S7comm behavior: Connections from non-engineering workstations, unusual data block access patterns, or write operations outside change windows
  • Reconnaissance indicators: Sequential IP scanning on port 102, repeated connection attempts with varying parameters, or enumeration of CPU properties
  • Tool artifacts: Snap7.dll library usage outside approved engineering workstations, Python scripts with S7comm functionality, or unauthorized monitoring software installations
  • Temporal anomalies: S7comm activity during off-hours, unexpected connection patterns consistent with automated scripting rather than human operators, or configuration changes without corresponding work orders or change tickets
  • Geographic anomalies: Connections originating from unexpected countries or IP ranges not associated with vendors or integrators

  Preventative hardening actions

  To counter threats to PLCs, the authoring agencies recommend all PLC owners and operators follow the mitigations in joint guidance Primary Mitigations to Reduce Cyber Threats to Operational Technology.

  To harden Siemens S7 Series PLCs, the authoring agencies strongly urge all owners implement the hardening steps below. Entities that rely on systems integrators or third-party managed service providers should share this advisory with those parties and request implementation of the following mitigations:

  1. Conduct an immediate inventory of all Siemens S7 Series PLCs in your environment [D3-HCI]:

  • Verify current firmware versions for all S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers against backup gold copy
  • Identify any systems directly or indirectly accessible from untrusted networks
  • Map all engineering workstations with Totally Integrated Automation (TIA) Portal, STEP 7, or S7 programming access

  2. Apply critical security patches as soon as possible [D3-SU]:

  • Update Siemens S7 Series PLC firmware to the latest versions that address known vulnerabilities
  • Prioritize Internet-facing or demilitarized zone (DMZ)-resident controllers
  • Update TIA Portal and STEP 7 software to current versions
  • Consult Siemens ProductCERT advisories for information on known vulnerabilities, along with relevant workarounds and mitigations
  • Test all updates in a development environment before production deployment

  3. Verify network segmentation and ensure PLCs are NOT accessible from the Internet [D3-NI]:

  • Audit firewall rules for any exposed S7comm services (Transmission Control Protocol [TCP] port 102)
  • Block TCP port 102 at perimeter firewalls entirely
  • Implement a DMZ architecture that separates OT and IT networks
  • Deploy unidirectional gateways for data historian connections where appropriate
  • Verify there is no unauthorized routing between corporate and industrial networks

  4. Review and strengthen access controls [D3-NAM,D3-CH]:

  • Restrict TIA Portal/STEP 7 access to authorized engineering workstations only by MAC/IP allowlisting on PLCs
  • Enable PLC password protection on all Siemens S7 Series controllers 
  • Configure protection levels (such as write protection and read/write protection) on Siemens S7 Series devices
  • Remove or change default SNMP community strings
  • Implement application allowlisting on all engineering workstations
  • Enable multi-factor authentication for all remote access to OT networks

  5. Enable comprehensive logging and monitoring [D3-PM,D3-NTA]:

  • Deploy ICS-aware intrusion detection (e.g., Claroty, Dragos Platform, Nozomi Networks, or similar)
  • Monitor all S7comm traffic on TCP port 102 for connections outside maintenance windows
  • Alert on unauthorized PUT/GET operations, especially write commands to data blocks or configuration areas of memory
  • Log all TIA Portal/STEP 7 connections to PLCs with timestamps and source IPs
  • Establish a baseline for legitimate behavior and configure monitoring tools to alert on deviations
  • Monitor for Python processes with snap7.dll library imports on engineering workstations
  • Watch for sequential IP scanning patterns or block reads of configuration data

  6. Implement S7-specific hardening measures [D3-ACH]:

  • Disable web servers on Siemens S7 Series devices if not operationally required
  • Disable unused communication protocols (such as Modbus TCP and PROFINET, if they are not required)
  • Configure connection resources to limit simultaneous S7comm sessions
  • Enable TIA Portal/STEP 7 “complete restart protection” and “know-how protection” features where available
  • Evaluate for ladder logic changes in online/offline modes

  7. Contact Siemens for model-specific guidance:

  • Engage Siemens Technical Support for hardening recommendations specific to your CPU models and firmware versions
  • Verify patch compatibility with your specific operational environment and third-party integrations
  • Request assistance with protection level configuration and access control implementation

  Conclusion

  There is an active threat targeting Internet-exposed Siemens S7 Series PLCs. The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations. Organizations should treat this Cybersecurity Advisory with urgency and coordinate response efforts across security, engineering, executive leadership, plant operations, and vendor support teams to implement the recommended detection and hardening actions.

  Resources

  • Primary Mitigations to Reduce Cyber Threats to Operational Technology
  • Secure connectivity principles for Operational Technology (OT): How organisations should design, secure, and manage connectivity in OT
  • Control System Defense: Know the Opponent

  Incident reporting 

  U.S. organizations are encouraged to report suspicious or criminal activity related to information in this advisory to CISA and/or the FBI. Contact CISA via CISA’s 24/7 Operations Center at contact@cisa.dhs.gov or 1-844-Say-CISA (1-844-729-2472). File a claim with FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. When available, please include the following information regarding the incident: 

  • Date, time, and location of the incident;
  • Type of activity;
  • Number of people affected;
  • Type of equipment used for the activity; and
  • Name of the submitting company or organization, and a designated point of contact.

  Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact EnergySRMA@hq.doe.gov.

  In addition, consider contacting Siemens ProductCERT via https://www.siemens.com/cert or email productcert@siemens.com. 

  Disclaimer of endorsement
  The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

  Purpose
  This document was developed in furtherance of the authoring agencies’ cybersecurity missions, including their responsibilities to identify and disseminate threats and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

  Contact
  Cybersecurity Report Feedback: CybersecurityReports@nsa.gov

  Defense Industrial Base Inquiries and Cybersecurity Services: DIB_Defense@cyber.nsa.gov

  Media Inquiries / Press Desk: NSA Media Relations: 443-634-0721, MediaRelations@nsa.gov

  Contact Siemens ProductCERT for up-to-date information about the security of Siemens products or to report cybersecurity vulnerabilities at productcert@siemens.com. For support with increasing the security of installed Siemens PLCs, contact Siemens Industrial Cybersecurity Services at services.automation@siemens.com. See Siemens ProductCERT and Siemens CERT for more information.

  Appendix A: MITRE ATT&CK tactics and techniques

  See Table 1for the threat actor tactics and techniques referenced in this advisory.

  Table 1: MITRE ATT&CK tactics and techniques

  Tactic	Technique Title	ID	Use
  Reconnaissance	Search Open Technical Databases: Scan Databases	T1596.005	Using Internet scanning services to identify Internet-exposed or poorly segmented Siemens S7 Series PLCs
  Resource Development	Develop Capabilities: Exploits	T1587.004	Developing exploits for known Siemens S7 Series PLC vulnerabilities
  Resource Development	Obtain Capabilities: Artificial Intelligence	T1588.007	Rapidly iterating exploit code through AI-assisted development
  Execution	Native API	T0834	Deploying AI-generated Python scripts incorporating the snap7.dll library
  Execution	Modify Controller Tasking	T0821	Conducting write operations on data blocks, potentially for pre-positioning for effects operations
  Evasion	Masquerading	T0849	Masquerading as legitimate monitoring tools to evade detection
  Lateral Movement	Insecure Credentials	T1694	Accessing exposed devices that have unconfigured (default) or minimally configured authentication
  Collection	Data from Local System	T0893	Conducting read operations on data blocks, potentially for reconnaissance

  Appendix B: MITRE D3FEND countermeasures

  See Table 2 for a mapping of several of the cybersecurity countermeasures mentioned in this advisory.

  Table 2: MITRE D3FEND Countermeasures

  Countermeasure Title	ID	Description
  Hardware Component Inventory	D3-HCI	Conduct an immediate inventory of all Siemens S7 Series PLCs
  Software Update	D3-SU	Apply critical security patches as soon as possible
  Network Isolation	D3-NI	Verify network segmentation and ensure PLCs are not accessible from the Internet
  Network Access Mediation	D3-NAM	Restrict TIA Portal/STEP 7 access to authorized engineering workstations only via MAC/IP allowlisting on PLCs
  Credential Hardening	D3-CH	Enable PLC password protection on all S7 controllers Enable multi-factor authentication for all remote access to OT networks
  Platform Monitoring	D3-PM	Deploy ICS-aware intrusion detection Alert on unauthorized PUT/GET operations Monitor for unexpected behavior deviations Monitor for snap7.dll library imports Hunt for indicators of compromise
  Network Traffic Analysis	D3-NTA	Alert on unexpected S7comm traffic on TCP port 102  Watch for sequential IP scanning patterns
  Application Configuration Hardening	D3-ACH	Disable unused web servers and protocols Remove SNMP community strings Watch for ladder logic changes

  Notes

  ¹ MITRE and ATT&CK are registered trademarks of The MITRE Corporation. MITRE D3FEND is a trademark of the MITRE Corporation.