…ltration. [11] S0538 Crutch Crutch has exfiltrated stolen data to Dropbox. [12] G1006 Earth Lusca Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA. [13] G1003 Ember Bear Ember Bear has used tools such as Rclone to exfiltrate information f…

…eat Research. (2019, October 7). China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations. Retrieved April 12, 2021. Insikt Group. (2020, July 28). CHINESE STATE-SPONSORED GROUP ‘REDDELTA’ TARGETS THE VATICAN AND CATHOLIC ORGANIZATIONS. Retri…

…system user information. [43] S0266 TrickBot TrickBot can identify the user and groups the user belongs to on a compromised host. [214] S0094 Trojan.Karagany Trojan.Karagany can gather information about the user on a compromised host. [215] G0081 Tropic Trooper Tropic Trooper use…

…rs Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020. …

…e Dyre has the ability to identify network settings on a compromised host. [76] G1006 Earth Lusca Earth Lusca used the command ipconfig to obtain information about network configurations. [77] S0605 EKANS EKANS can determine the domain of a compromised host. [78] S0081 Elise Elis…

…December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018. Magisa, L. (2020, November 27). New MacOS Backdoor Connecte…

…en disguised as a legitimate Windows binary such as w3wp.exe or conn.exe . [61] G1006 Earth Lusca Earth Lusca used the command move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll to move and register a malicious DLL name as a Windows print processor, which eventuall…

…December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved M…

…ewhere, stating that ‘[t]he theater […] was an institution where various social groups mingled – men, women, citizens, ambassadors from abroad, apprentices, country gentlemen in town for the law term […]’.39 This 36 37 38 39 Shakespeare and the Geography of Difference, p. 35. See…

…ewhere, stating that ‘[t]he theater […] was an institution where various social groups mingled – men, women, citizens, ambassadors from abroad, apprentices, country gentlemen in town for the law term […]’.39 This 36 Shakespeare and the Geography of Difference, p. 35. See also esp…

…ewhere, stating that ‘[t]he theater […] was an institution where various social groups mingled – men, women, citizens, ambassadors from abroad, apprentices, country gentlemen in town for the law term […]’.39 This 36 Shakespeare and the Geography of Difference, p. 35. See also esp…

…ewhere, stating that ‘[t]he theater […] was an institution where various social groups mingled – men, women, citizens, ambassadors from abroad, apprentices, country gentlemen in town for the law term […]’.39 This 36 Shakespeare and the Geography of Difference, p. 35. See also esp…

…ewhere, stating that ‘[t]he theater […] was an institution where various social groups mingled – men, women, citizens, ambassadors from abroad, apprentices, country gentlemen in town for the law term […]’.39 This 36 Shakespeare and the Geography of Difference, p. 35. See also esp…

…erf leverages Mimikatz and Windows Credential Editor to steal credentials. [31] G1006 Earth Lusca Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process. [32] G1003 Ember Bear Ember Bear uses legitimate Sysinternals tools such…

… Education Prog Coord 10 G1005 NONE Non-Exempt Medical Education Prog Asst 1 08 G1006 NONE Non-Exempt Stdnt Enrollment Assoc/Branch 08 G1009 NONE Non-Exempt Standardized Patient/Trainee 07 G1013 NONE Non-Exempt Medical Interpreter 09 T0047 NONE Non-Exempt Acct Operations Tech 3 0…