{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1113","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"94a071843092dc75d49f8b4644a99eada289eac50eaac07321d62cdc52ee3070","description":"Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1113","external_id":"T1113"},{"source_name":"CopyFromScreen .NET","description":"Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020.","url":"https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8"},{"source_name":"Antiquated Mac Malware","description":"Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.","url":"https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1113","technique_page":"techniques/enterprise/T1113/","page":"detections/enterprise/T1113/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"dbe4b9c5-c254-4258-9688-d6af0b7967fd","title":"Screen Capture with Import Tool","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/dbe4b9c5-c254-4258-9688-d6af0b7967fd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"e2f17c5d-b02a-442b-9052-6eb89c9fec9c","title":"Screen Capture with Xwd","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/e2f17c5d-b02a-442b-9052-6eb89c9fec9c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"0877ed01-da46-4c49-8476-d49cdd80dfa7","title":"Screen Capture - macOS","status":"test","level":"low","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/0877ed01-da46-4c49-8476-d49cdd80dfa7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_screencapture.yml","author":"remotephone, oscd.community","kind":"sigma"},{"id":"d4a11f63-2390-411c-9adf-d791fd152830","title":"Windows Screen Capture with CopyFromScreen","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/d4a11f63-2390-411c-9adf-d791fd152830.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml","author":"frack113","kind":"sigma"},{"id":"2158f96f-43c2-43cb-952a-ab4580f32382","title":"Screen Capture Activity Via Psr.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2158f96f-43c2-43cb-952a-ab4580f32382.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml","author":"Beyu Denis, oscd.community","kind":"sigma"},{"id":"817f252c-5143-4dae-b418-48c3e9f63728","title":"Windows Recall Feature Enabled Via Reg.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/817f252c-5143-4dae-b418-48c3e9f63728.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml","author":"Sajid Nawaz Khan","kind":"sigma"},{"id":"5dfc1465-8f65-4fde-8eb5-6194380c6a62","title":"Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted","status":"test","level":"medium","logsource":{"category":"registry_delete","product":"windows"},"data_path":"data/detection-rules/5dfc1465-8f65-4fde-8eb5-6194380c6a62.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_enable_windows_recall.yml","author":"Sajid Nawaz Khan","kind":"sigma"},{"id":"973ef012-8f1a-4c40-93b4-7e659a5cd17f","title":"Periodic Backup For System Registry Hives Enabled","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/973ef012-8f1a-4c40-93b4-7e659a5cd17f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_enable_periodic_backup.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"75180c5f-4ea1-461a-a4f6-6e4700c065d4","title":"Windows Recall Feature Enabled - Registry","status":"test","level":"medium","logsource":{"category":"registry_set","product":"windows"},"data_path":"data/detection-rules/75180c5f-4ea1-461a-a4f6-6e4700c065d4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_enable_windows_recall.yml","author":"Sajid Nawaz Khan","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1113-1","technique_id":"T1113","title":"T1113 Screen Capture","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#collection","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":159,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L159","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"c54a6409b9747fe628b6112cf9547b451d198642a41f4e508e9b903f7bda8d17","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(screen_capture_api_or_known_capture_tool) AND process NOT_IN approved_capture_apps -> ALERT","log_sources":[{"title":"Endpoint Detection and Response Telemetry","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#1-endpoint-detection-and-response-telemetry"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0346","name":"Detect Screen Capture via Commands and API Calls","url":"https://attack.mitre.org/detectionstrategies/DET0346","stix_id":"x-mitre-detection-strategy--a9de0990-69e9-4b1a-9754-1c7fb4102ac9","relationship_id":"relationship--2e10339a-3af5-45b5-b48c-9642e4bc7665","description":"","analytics":[{"id":"AN0980","name":"Analytic 0980","guidance":"Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.","url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0980","platforms":["Windows"],"tuning":[{"field":"ParentProcessName","description":"Depends on allowed parent process behaviors in the environment (e.g., explorer.exe vs powershell.exe)"},{"field":"TimeWindow","description":"Can tune alert thresholds for rapid or scheduled screenshots (e.g., interval-based screen capture)"},{"field":"ImageExtension","description":"To detect file writes (e.g., .bmp, .png) that deviate from typical user activity"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0980","source_url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0980","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0980","source_url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0980","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN0981","name":"Analytic 0981","guidance":"Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.","url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0981","platforms":["macOS"],"tuning":[{"field":"CommandLineRegex","description":"Customize regex for flag detection (e.g., `screencapture -x`) based on usage patterns"},{"field":"ParentProcessName","description":"May vary depending on expected screencapture behavior (Terminal vs remote agent)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process: exec","platforms":["macOS"],"analytic_id":"AN0981","source_url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0981","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0982","name":"Analytic 0982","guidance":"Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.","url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0982","platforms":["Linux"],"tuning":[{"field":"TerminalSession","description":"Filter based on TTY sessions or remote terminal usage"},{"field":"ExecutablePath","description":"Match against known location of xwd/import binaries or renamed variants"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0982","source_url":"https://attack.mitre.org/detectionstrategies/DET0346#AN0982","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0591","name":"ConnectWise","page":"tools/S0591/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1209","name":"Quick Assist","page":"tools/S1209/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0592","name":"RemoteUtilities","page":"tools/S0592/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0591","name":"ConnectWise","page":"tools/S0591/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0194","name":"PowerSploit","page":"tools/S0194/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1209","name":"Quick Assist","page":"tools/S1209/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0592","name":"RemoteUtilities","page":"tools/S0592/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]}],"software":[{"id":"S0004","name":"TinyZBot","url":"https://attack.mitre.org/software/S0004","kind":"malware","description":"[TinyZBot](https://attack.mitre.org/software/S0004) contains screen capture functionality.(Citation: Cylance Cleaver)","relationship_id":"relationship--6f01abdc-bd94-4645-afed-8d3bd365bba4","references":[{"source_name":"Cylance Cleaver","description":"Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) allows the operator to capture screenshots.(Citation: CIRCL PlugX March 2013)","relationship_id":"relationship--bb39cbf2-a9dc-4c31-9fb9-b6c456c2005c","references":[{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}]},{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) has a command to periodically take screenshots of the system.(Citation: Mandiant APT1 Appendix)","relationship_id":"relationship--2d920718-61fc-4e10-ad09-df0a00d69cd4","references":[{"source_name":"Mandiant APT1 Appendix","description":"Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) is capable of performing screen captures.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--c784f835-5d15-4fc6-a7ad-88d1a9050159","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"[CHOPSTICK](https://attack.mitre.org/software/S0023) has the capability to capture screenshots.(Citation: DOJ GRU Indictment Jul 2018)","relationship_id":"relationship--7201204c-d21f-4560-a3d1-c75fabacb4c4","references":[{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"id":"S0030","name":"Carbanak","url":"https://attack.mitre.org/software/S0030","kind":"malware","description":"[Carbanak](https://attack.mitre.org/software/S0030) performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.(Citation: FireEye CARBANAK June 2017)","relationship_id":"relationship--16d5d573-60bb-402c-88c3-2bc0af8388eb","references":[{"source_name":"FireEye CARBANAK June 2017","description":"Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) can capture the victim’s screen remotely.(Citation: Nccgroup Gh0st April 2018)","relationship_id":"relationship--b0a40611-da3c-4447-b0af-fa66f927b623","references":[{"source_name":"Nccgroup Gh0st April 2018","description":"Pantazopoulos, N. (2018, April 17). Decoding network data from a Gh0st RAT variant. Retrieved November 2, 2018.","url":"https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"A [JHUHUGIT](https://attack.mitre.org/software/S0044) variant takes screenshots by simulating the user pressing the \"Take Screenshot\" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.(Citation: Unit 42 Playbook Dec 2017)(Citation: Talos Seduploader Oct 2017)","relationship_id":"relationship--073215cd-bc1e-48e8-8f3a-7d24f18b32c6","references":[{"source_name":"Talos Seduploader Oct 2017","description":"Mercer, W., et al. (2017, October 22). \"Cyber Conflict\" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.","url":"https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"},{"source_name":"Unit 42 Playbook Dec 2017","description":"Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) takes periodic screenshots and exfiltrates them.(Citation: F-Secure Cosmicduke)","relationship_id":"relationship--7331b11d-1d5e-4275-ba7e-a83ec4a59259","references":[{"source_name":"F-Secure Cosmicduke","description":"F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) captures PNG screenshots of the main screen.(Citation: Kaspersky MoleRATs April 2019)","relationship_id":"relationship--a724a449-cd4d-419a-90a0-cdd5927c60b7","references":[{"source_name":"Kaspersky MoleRATs April 2019","description":"GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"id":"S0086","name":"ZLib","url":"https://attack.mitre.org/software/S0086","kind":"malware","description":"[ZLib](https://attack.mitre.org/software/S0086) has the ability to obtain screenshots of the compromised system.(Citation: Cylance Dust Storm)","relationship_id":"relationship--7296e1e2-514d-4a6c-a1fe-18558a5e3b0f","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0088","name":"Kasidet","url":"https://attack.mitre.org/software/S0088","kind":"malware","description":"[Kasidet](https://attack.mitre.org/software/S0088) has the ability to initiate keylogging and screen captures.(Citation: Zscaler Kasidet)","relationship_id":"relationship--ade60661-8dfb-473a-8d12-014ba0273934","references":[{"source_name":"Zscaler Kasidet","description":"Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) is capable of taking screenshots.(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--147d2e66-25de-42ea-8592-eb51333f595c","references":[{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0090","name":"Rover","url":"https://attack.mitre.org/software/S0090","kind":"malware","description":"[Rover](https://attack.mitre.org/software/S0090) takes screenshots of the compromised system's desktop and saves them to <code>C:\\system\\screenshot.bmp</code> for exfiltration every 60 minutes.(Citation: Palo Alto Rover)","relationship_id":"relationship--6184b127-47cf-43fc-880b-890554d9cc9a","references":[{"source_name":"Palo Alto Rover","description":"Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can take a desktop screenshot and save the file into <code>\\ProgramData\\Mail\\MailAg\\shot.png</code>.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--0bd9fd2b-e2f7-48f1-8988-31c041691585","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0098","name":"T9000","url":"https://attack.mitre.org/software/S0098","kind":"malware","description":"[T9000](https://attack.mitre.org/software/S0098) can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.(Citation: Palo Alto T9000 Feb 2016)","relationship_id":"relationship--dd89d8a2-257a-47f9-8b55-8011ca53007b","references":[{"source_name":"Palo Alto T9000 Feb 2016","description":"Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}]},{"id":"S0113","name":"Prikormka","url":"https://attack.mitre.org/software/S0113","kind":"malware","description":"[Prikormka](https://attack.mitre.org/software/S0113) contains a module that captures screenshots of the victim's desktop.(Citation: ESET Operation Groundbait)","relationship_id":"relationship--290c4e3b-00be-411f-b0c8-919e85e08a49","references":[{"source_name":"ESET Operation Groundbait","description":"Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) contains a command to perform screen captures.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)","relationship_id":"relationship--717d87d5-df97-48a9-8766-c9a947541e1d","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0128","name":"BADNEWS","url":"https://attack.mitre.org/software/S0128","kind":"malware","description":"[BADNEWS](https://attack.mitre.org/software/S0128) has a command to take a screenshot and send it to the C2 server.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018)","relationship_id":"relationship--11010986-1b4d-4158-b47d-bbff34306c98","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"PaloAlto Patchwork Mar 2018","description":"Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"}]},{"id":"S0143","name":"Flame","url":"https://attack.mitre.org/software/S0143","kind":"malware","description":"[Flame](https://attack.mitre.org/software/S0143) can take regular screenshots when certain applications are open that are sent to the command and control server.(Citation: Kaspersky Flame)","relationship_id":"relationship--7ba62129-a4ba-42b4-9971-4a650682cb52","references":[{"source_name":"Kaspersky Flame","description":"Gostev, A. (2012, May 28). The Flame: Questions and Answers. Retrieved March 1, 2017.","url":"https://securelist.com/the-flame-questions-and-answers-51/34344/"}]},{"id":"S0147","name":"Pteranodon","url":"https://attack.mitre.org/software/S0147","kind":"malware","description":"[Pteranodon](https://attack.mitre.org/software/S0147) can capture screenshots at a configurable interval.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: Unit 42 Gamaredon February 2022)","relationship_id":"relationship--0471088d-7b45-4fec-8946-ae5bf463286b","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","description":"Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can capture screenshots.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--f6d23c00-158e-4e39-bf9b-f18344cd0151","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0151","name":"HALFBAKED","url":"https://attack.mitre.org/software/S0151","kind":"malware","description":"[HALFBAKED](https://attack.mitre.org/software/S0151) can obtain screenshots from the victim.(Citation: FireEye FIN7 April 2017)","relationship_id":"relationship--b4795040-fe94-429a-9853-f30c09ba05aa","references":[{"source_name":"FireEye FIN7 April 2017","description":"Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}]},{"id":"S0152","name":"EvilGrab","url":"https://attack.mitre.org/software/S0152","kind":"malware","description":"[EvilGrab](https://attack.mitre.org/software/S0152) has the capability to capture screenshots.(Citation: PWC Cloud Hopper Technical Annex April 2017)","relationship_id":"relationship--b2b873cd-8618-426e-9cae-9e6755acafad","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0153","name":"RedLeaves","url":"https://attack.mitre.org/software/S0153","kind":"malware","description":"[RedLeaves](https://attack.mitre.org/software/S0153) can capture screenshots.(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 2018)","relationship_id":"relationship--48fb8267-5d68-467b-a2c0-8302cc15ebed","references":[{"source_name":"Accenture Hogfish April 2018","description":"Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"},{"source_name":"FireEye APT10 April 2017","description":"FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154)'s Beacon payload is capable of capturing screenshots.(Citation: cobaltstrike manual)(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--4183341a-f5ed-4914-9dc5-0eb7c1d6c4e6","references":[{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","description":"Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021.","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.(Citation: XAgentOSX 2017)","relationship_id":"relationship--c0223316-4b0b-461e-8947-01c0f5baeef2","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0163","name":"Janicab","url":"https://attack.mitre.org/software/S0163","kind":"malware","description":"[Janicab](https://attack.mitre.org/software/S0163) captured screenshots and sent them out to a C2 server.(Citation: f-secure janicab)(Citation: Janicab)","relationship_id":"relationship--fc67e15c-ae09-45e1-925f-8a6b0e8ca4ab","references":[{"source_name":"f-secure janicab","description":"Brod. (2013, July 15). Signed Mac Malware Using Right-to-Left Override Trick. Retrieved July 17, 2017.","url":"https://www.f-secure.com/weblog/archives/00002576.html"},{"source_name":"Janicab","description":"Thomas. (2013, July 15). New signed malware called Janicab. Retrieved July 17, 2017.","url":"https://web.archive.org/web/20230331162455/https://www.thesafemac.com/new-signed-malware-called-janicab/"}]},{"id":"S0167","name":"Matryoshka","url":"https://attack.mitre.org/software/S0167","kind":"malware","description":"[Matryoshka](https://attack.mitre.org/software/S0167) is capable of performing screen captures.(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)","relationship_id":"relationship--a56aafe6-4a54-4ce5-b927-8b56826b3445","references":[{"source_name":"ClearSky Wilted Tulip July 2017","description":"ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.","url":"http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"CopyKittens Nov 2015","description":"Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved November 17, 2024.","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--0c1f6d5f-3094-4834-94a9-5a615e7c319c","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) can capture a screenshot from a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--ed522c9c-038b-43c0-af66-e81b954104f2","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0187","name":"Daserf","url":"https://attack.mitre.org/software/S0187","kind":"malware","description":"[Daserf](https://attack.mitre.org/software/S0187) can take screenshots.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--6db82410-1fcf-483a-be5b-cf09c361b4eb","references":[{"source_name":"Trend Micro Daserf Nov 2017","description":"Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/redbaldknight-bronze-butler-daserf-backdoor-now-using-steganography/"},{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.(Citation: GitHub Pupy)","relationship_id":"relationship--09869965-8dcd-4c20-a997-c075b6ed0434","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0194","name":"PowerSploit","url":"https://attack.mitre.org/software/S0194","kind":"tool","description":"[PowerSploit](https://attack.mitre.org/software/S0194)'s <code>Get-TimedScreenshot</code> Exfiltration module can take screenshots at regular intervals.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)","relationship_id":"relationship--792c5ad3-87ca-473f-998b-654f29a5b10f","references":[{"source_name":"GitHub PowerSploit May 2012","description":"PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","description":"PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.","url":"http://powersploit.readthedocs.io"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can capture the victim's screen.(Citation: McAfee Netwire Mar 2015)(Citation: FireEye NETWIRE March 2019)(Citation: Red Canary NETWIRE January 2020)(Citation: Proofpoint NETWIRE December 2020)","relationship_id":"relationship--ca71a63a-4481-46d2-98b2-b83cce190380","references":[{"source_name":"Red Canary NETWIRE January 2020","description":"Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"FireEye NETWIRE March 2019","description":"Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"},{"source_name":"McAfee Netwire Mar 2015","description":"McAfee. (2015, March 2). Netwire RAT Behind Recent Targeted Attacks. Retrieved February 15, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/"},{"source_name":"Proofpoint NETWIRE December 2020","description":"Proofpoint. (2020, December 2). Geofenced NetWire Campaigns. Retrieved January 7, 2021.","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}]},{"id":"S0199","name":"TURNEDUP","url":"https://attack.mitre.org/software/S0199","kind":"malware","description":"[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of taking screenshots.(Citation: FireEye APT33 Sept 2017)","relationship_id":"relationship--09c63f56-1c5b-4195-9d1a-73b77865ffb8","references":[{"source_name":"FireEye APT33 Sept 2017","description":"O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--a883e4c6-6a40-4660-9120-b2430099ccb6","references":[{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0213","name":"DOGCALL","url":"https://attack.mitre.org/software/S0213","kind":"malware","description":"[DOGCALL](https://attack.mitre.org/software/S0213) is capable of capturing screenshots of the victim's machine.(Citation: FireEye APT37 Feb 2018)(Citation: Unit 42 Nokki Oct 2018)","relationship_id":"relationship--8d761618-146f-4219-9b50-a4ceca6b2210","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source_name":"Unit 42 Nokki Oct 2018","description":"Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}]},{"id":"S0216","name":"POORAIM","url":"https://attack.mitre.org/software/S0216","kind":"malware","description":"[POORAIM](https://attack.mitre.org/software/S0216) can perform screen capturing.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--4e2f4bbd-ea3b-4996-bc2a-3d670d9f5cf5","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0217","name":"SHUTTERSPEED","url":"https://attack.mitre.org/software/S0217","kind":"malware","description":"[SHUTTERSPEED](https://attack.mitre.org/software/S0217) can capture screenshots.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--d8a844bc-373b-44aa-831a-da33d1505ae3","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) can retrieve screenshots from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--e93c8f61-b2c9-4877-8c2c-12bd37aa5a87","references":[{"source_name":"FireEye MuddyWater Mar 2018","description":"Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) is capable of taking an image of and uploading the current desktop.(Citation: Lookout Dark Caracal Jan 2018)(Citation: CheckPoint Bandook Nov 2020)","relationship_id":"relationship--a80ece05-37e1-4828-a9e8-27b30524960b","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"},{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0235","name":"CrossRAT","url":"https://attack.mitre.org/software/S0235","kind":"malware","description":"[CrossRAT](https://attack.mitre.org/software/S0235) is capable of taking screen captures.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--28d4a66d-2b1f-4662-9e8e-4ba8ff4bcaf0","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can capture screenshots of the infected system using the `gdi32` library.(Citation: Talos ROKRAT)(Citation: Talos ROKRAT 2)(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--c4f662d6-7e47-4161-bf8d-dd445ae901b1","references":[{"source_name":"Talos ROKRAT","description":"Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"},{"source_name":"Talos ROKRAT 2","description":"Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"},{"source_name":"Securelist ScarCruft May 2019","description":"GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"NCCGroup RokRat Nov 2018","description":"Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) collects screenshots of the victim machine.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--b81d449d-9ebd-4fb8-a77a-bb6bca93581b","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"A variant of [Zebrocy](https://attack.mitre.org/software/S0251) captures screenshots of the victim’s machine in JPEG and BMP format.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)","relationship_id":"relationship--3e2d4ce8-0006-4571-b8ea-dbfc4bf7302f","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","description":"Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) can perform screen captures of the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--8140f09f-af3b-45e1-ae7c-f2dc85b8930e","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--45a1721f-67a3-479a-befe-d136ed0fdad3","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0261","name":"Catchamas","url":"https://attack.mitre.org/software/S0261","kind":"malware","description":"[Catchamas](https://attack.mitre.org/software/S0261) captures screenshots based on specific keywords in the window’s title.(Citation: Symantec Catchamas April 2018)","relationship_id":"relationship--f2f155f1-5152-4681-9c0b-b4a01968fa2e","references":[{"source_name":"Symantec Catchamas April 2018","description":"Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) captures screenshots of the victim’s screen.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--b2ae2606-fea8-4caf-a79e-91f09932d6d4","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0270","name":"RogueRobin","url":"https://attack.mitre.org/software/S0270","kind":"malware","description":"[RogueRobin](https://attack.mitre.org/software/S0270) has a command named <code>$screenshot</code> that may be responsible for taking screenshots of the victim machine.(Citation: Unit 42 DarkHydrus July 2018)","relationship_id":"relationship--e769177d-17b8-443b-b939-206d724fbb40","references":[{"source_name":"Unit 42 DarkHydrus July 2018","description":"Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) can capture screenshots of the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--c2888af5-ccdd-43f1-947c-1abd69272ec2","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0273","name":"Socksbot","url":"https://attack.mitre.org/software/S0273","kind":"malware","description":"[Socksbot](https://attack.mitre.org/software/S0273) can take screenshots.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--bec2b0d9-b76e-4acb-a9a4-adebe4c854c0","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0275","name":"UPPERCUT","url":"https://attack.mitre.org/software/S0275","kind":"malware","description":"[UPPERCUT](https://attack.mitre.org/software/S0275) can capture desktop screenshots in the PNG format and send them to the C2 server.(Citation: FireEye APT10 Sept 2018)(Citation: Trend Micro Earth Kasha Updates APR 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)","relationship_id":"relationship--4f2fb45a-8359-4c75-93ae-095fcf9f856e","references":[{"source_name":"ESET MirrorFace 2025","description":" Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"},{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","description":"Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"S0277","name":"FruitFly","url":"https://attack.mitre.org/software/S0277","kind":"malware","description":"[FruitFly](https://attack.mitre.org/software/S0277) takes screenshots of the user's desktop.(Citation: objsee mac malware 2017)","relationship_id":"relationship--97a68907-3642-4f23-aeae-55ad5bbd7b86","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0279","name":"Proton","url":"https://attack.mitre.org/software/S0279","kind":"malware","description":"[Proton](https://attack.mitre.org/software/S0279) captures the content of the desktop with the screencapture binary.(Citation: objsee mac malware 2017)","relationship_id":"relationship--cdb1549e-d3e6-4826-8f42-ca85fa9d08eb","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0282","name":"MacSpy","url":"https://attack.mitre.org/software/S0282","kind":"malware","description":"[MacSpy](https://attack.mitre.org/software/S0282) can capture screenshots of the desktop over multiple monitors.(Citation: objsee mac malware 2017)","relationship_id":"relationship--e67e4cbe-e8f6-433b-a1d2-e869c35f6a52","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) has the capability to take screenshots of the victim’s machine.(Citation: jRAT Symantec Aug 2018)(Citation: Kaspersky Adwind Feb 2016)","relationship_id":"relationship--ea2f957a-b144-4f06-b3fe-891df62f9444","references":[{"source_name":"jRAT Symantec Aug 2018","description":"Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"},{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) can take screenshots of the victim’s machine.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--4ab6eb52-821c-45da-b7d9-63840fe657cf","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can capture screenshots of the victim’s desktop.(Citation: Talos Agent Tesla Oct 2018)(Citation: DigiTrust Agent Tesla Jan 2017)(Citation: Fortinet Agent Tesla April 2018)(Citation: Fortinet Agent Tesla June 2017)(Citation: Bitdefender Agent Tesla April 2020)","relationship_id":"relationship--08109d9e-3258-4b9b-8e1d-ea90d05c18b9","references":[{"source_name":"Talos Agent Tesla Oct 2018","description":"Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"},{"source_name":"DigiTrust Agent Tesla Jan 2017","description":"The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"},{"source_name":"Fortinet Agent Tesla April 2018","description":"Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Fortinet Agent Tesla June 2017","description":"Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"},{"source_name":"Bitdefender Agent Tesla April 2020","description":"Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) takes automated screenshots of the infected machine.(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--988a0f0f-b3dc-4ff7-8062-29d3975cb897","references":[{"source_name":"Riskiq Remcos Jan 2018","description":"Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0337","name":"BadPatch","url":"https://attack.mitre.org/software/S0337","kind":"malware","description":"[BadPatch](https://attack.mitre.org/software/S0337) captures screenshots in .jpg format and then exfiltrates them.(Citation: Unit 42 BadPatch Oct 2017)","relationship_id":"relationship--5249b0e7-878e-44db-9d59-f162067f1852","references":[{"source_name":"Unit 42 BadPatch Oct 2017","description":"Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}]},{"id":"S0338","name":"Cobian RAT","url":"https://attack.mitre.org/software/S0338","kind":"malware","description":"[Cobian RAT](https://attack.mitre.org/software/S0338) has a feature to perform screen capture.(Citation: Zscaler Cobian Aug 2017)","relationship_id":"relationship--0f64f141-1f0f-4374-879d-b08f0fda8979","references":[{"source_name":"Zscaler Cobian Aug 2017","description":"Yadav, A., et al. (2017, August 31). Cobian RAT – A backdoored RAT. Retrieved November 13, 2018.","url":"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"}]},{"id":"S0339","name":"Micropsia","url":"https://attack.mitre.org/software/S0339","kind":"malware","description":"[Micropsia](https://attack.mitre.org/software/S0339) takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.(Citation: Radware Micropsia July 2018)","relationship_id":"relationship--b8a7be73-89a5-4689-8eea-280b745bd3cc","references":[{"source_name":"Radware Micropsia July 2018","description":"Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}]},{"id":"S0340","name":"Octopus","url":"https://attack.mitre.org/software/S0340","kind":"malware","description":"[Octopus](https://attack.mitre.org/software/S0340) can capture screenshots of the victims’ machine.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)","relationship_id":"relationship--f590ef19-3b83-459d-993c-a599407b7ca0","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"Security Affairs DustSquad Oct 2018","description":"Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.","url":"https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"},{"source_name":"ESET Nomadic Octopus 2018","description":"Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can capture screenshots of the victim’s machines.(Citation: Unit42 Azorult Nov 2018)","relationship_id":"relationship--ed8a6815-fd13-4e73-9b17-6b4025c0861c","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) can capture screenshots.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--f44842c1-f17d-4bb0-8803-3eee13cf831e","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can take a screenshot of the desktop.(Citation: Unit42 Cannon Nov 2018)","relationship_id":"relationship--3d1fe308-5bef-4e7a-9daa-333680a11d7b","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) can take screenshots of the victim’s machine.(Citation: Talos Konni May 2017)","relationship_id":"relationship--af7323ae-bb42-49fd-9c8d-218a1335f662","references":[{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) is capable of capturing screenshots on Windows and macOS systems.(Citation: Github PowerShell Empire)","relationship_id":"relationship--21c130df-4123-4f57-9ea2-9ceac05af597","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0375","name":"Remexi","url":"https://attack.mitre.org/software/S0375","kind":"malware","description":"[Remexi](https://attack.mitre.org/software/S0375) takes screenshots of windows of interest.(Citation: Securelist Remexi Jan 2019)","relationship_id":"relationship--d5b4ef43-ddb4-4f95-95b9-6a352700bb77","references":[{"source_name":"Securelist Remexi Jan 2019","description":"Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}]},{"id":"S0379","name":"Revenge RAT","url":"https://attack.mitre.org/software/S0379","kind":"malware","description":"[Revenge RAT](https://attack.mitre.org/software/S0379) has a plugin for screen capture.(Citation: Cylance Shaheen Nov 2018)","relationship_id":"relationship--c67ddbdb-7e07-45b3-9f7d-5cdf959ac3b2","references":[{"source_name":"Cylance Shaheen Nov 2018","description":"Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) can take screenshots.(Citation: Kaspersky StoneDrill 2017)\t","relationship_id":"relationship--f097324d-6665-4d2d-8d84-eb05bada0dd3","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) can capture screenshots.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--9cb17d40-fe0f-4b68-bac7-78778c8772d7","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can capture screenshots of the victim’s machines.(Citation: Trend Micro njRAT 2018)(Citation: Kaspersky BlindEagle AUG 2024)","relationship_id":"relationship--36cdeef3-a216-44cd-ad79-dd8085e86fc3","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","description":"Global Research & Analysis Team, Kaspersky. (2024, August 19). BlindEagle flying high in Latin America. Retrieved April 16, 2026.","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used hooked APIs to take screenshots.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)","relationship_id":"relationship--83c4e8d9-1746-43eb-af67-71e10a24da6f","references":[{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"},{"source_name":"TrendMicro BKDR_URSNIF.SM","description":"Sioting, S. (2013, June 15). BKDR_URSNIF.SM. Retrieved June 5, 2019.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"}]},{"id":"S0387","name":"KeyBoy","url":"https://attack.mitre.org/software/S0387","kind":"malware","description":"[KeyBoy](https://attack.mitre.org/software/S0387) has a command to perform screen grabbing.(Citation: PWC KeyBoys Feb 2017)","relationship_id":"relationship--bd2f299e-e471-4f32-96b6-8dc32e872c74","references":[{"source_name":"PWC KeyBoys Feb 2017","description":"Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}]},{"id":"S0398","name":"HyperBro","url":"https://attack.mitre.org/software/S0398","kind":"malware","description":"[HyperBro](https://attack.mitre.org/software/S0398) has the ability to take screenshots.(Citation: Unit42 Emissary Panda May 2019)","relationship_id":"relationship--90ce2bf5-4fef-4d9d-b670-2a5ae8b7ba4d","references":[{"source_name":"Unit42 Emissary Panda May 2019","description":"Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) captures screenshots.(Citation: ESET Machete July 2019)(Citation: Securelist Machete Aug 2014)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)","relationship_id":"relationship--fb99048f-bb37-47be-b2a5-d03d9ff087f1","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","description":"Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.","url":"https://securelist.com/el-machete/66108/"},{"source_name":"Cylance Machete Mar 2017","description":"The Cylance Threat Research Team. (2017, March 22). El Machete's Malware Attacks Cut Through LATAM. Retrieved September 13, 2019.","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","description":"kate. (2020, September 25). APT-C-43 steals Venezuelan military secrets to provide intelligence support for the reactionaries — HpReact campaign. Retrieved November 20, 2020.","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can capture screenshots.(Citation: FireEye APT41 Aug 2019)","relationship_id":"relationship--4b3274fe-1960-4d1e-91d1-2091e467c45b","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"S0417","name":"GRIFFON","url":"https://attack.mitre.org/software/S0417","kind":"malware","description":"[GRIFFON](https://attack.mitre.org/software/S0417) has used a screenshot module that can be used to take a screenshot of the remote system.(Citation: SecureList Griffon May 2019)","relationship_id":"relationship--06b747a6-a3d2-441e-9a24-b79491be3647","references":[{"source_name":"SecureList Griffon May 2019","description":"Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has the ability to take screen captures.(Citation: Talos PoetRAT April 2020)(Citation: Dragos Threat Report 2020)","relationship_id":"relationship--d9338b91-b07b-4ea1-9e2f-4fe06e58ce62","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"},{"source_name":"Dragos Threat Report 2020","description":"Dragos. (n.d.). ICS Cybersecurity Year in Review 2020. Retrieved February 25, 2021.","url":"https://hub.dragos.com/hubfs/Year-in-Review/Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to do real time screen viewing on an infected host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--ee1b1aee-a635-4008-813d-fab125f0b0a5","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0437","name":"Kivars","url":"https://attack.mitre.org/software/S0437","kind":"malware","description":"[Kivars](https://attack.mitre.org/software/S0437) has the ability to capture screenshots on the infected host.(Citation: TrendMicro BlackTech June 2017)","relationship_id":"relationship--8a039d93-db2d-4a98-81d4-357425574bab","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438)'s has a plugin that captures screenshots of the target applications.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--75a82c43-c3f2-4cec-a9cb-3407b03f27b7","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0454","name":"Cadelspy","url":"https://attack.mitre.org/software/S0454","kind":"malware","description":"[Cadelspy](https://attack.mitre.org/software/S0454) has the ability to capture screenshots and webcam photos.(Citation: Symantec Chafer Dec 2015)","relationship_id":"relationship--dd812f2c-a0a0-4543-af23-25e71c899bf4","references":[{"source_name":"Symantec Chafer Dec 2015","description":"Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) can collect screenshots of the victim’s machine.(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019) ","relationship_id":"relationship--b5d200f9-2b85-46c8-980a-0692e49ccdfc","references":[{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to capture screenshots on compromised hosts.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--535b87bb-31fd-4e14-8279-c64c301e912d","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can take screenshots every 30 seconds as well as when an external removable storage device is connected.(Citation: Antiy CERT Ramsay April 2020)","relationship_id":"relationship--145d2112-b679-4d72-b484-7524f944e128","references":[{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--3edc3698-c8a9-4212-b34e-1f3a44fbd00d","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) has the ability to take screenshots on a compromised host.(Citation: Cybereason Valak May 2020)\t ","relationship_id":"relationship--5797b454-e7cc-45a3-9bf1-7708d7286531","references":[{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) can capture display screenshots with the screens_dll.dll plugin.(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--e1a70685-4492-4866-a10b-7630be265c86","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}]},{"id":"S0495","name":"RDAT","url":"https://attack.mitre.org/software/S0495","kind":"malware","description":"[RDAT](https://attack.mitre.org/software/S0495) can take a screenshot on the infected system.(Citation: Unit42 RDAT July 2020)\t","relationship_id":"relationship--49d50fde-cfbc-4007-befc-f4b22b9bc9f5","references":[{"source_name":"Unit42 RDAT July 2020","description":"Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has taken a screenshot of a victim's desktop, named it \"Filter3.jpg\", and stored it in the local directory.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--e7477fbb-361f-4502-99d4-75576d6d3ac7","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0546","name":"SharpStage","url":"https://attack.mitre.org/software/S0546","kind":"malware","description":"[SharpStage](https://attack.mitre.org/software/S0546) has the ability to capture the victim's screen.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)","relationship_id":"relationship--45060bf9-f01b-48a2-8a03-082ad7e7945f","references":[{"source_name":"Cybereason Molerats Dec 2020","description":"Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"},{"source_name":"BleepingComputer Molerats Dec 2020","description":"Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can take desktop screenshots.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--8630a3fb-9f65-4c54-b3d6-c379d03029dc","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0591","name":"ConnectWise","url":"https://attack.mitre.org/software/S0591","kind":"tool","description":"[ConnectWise](https://attack.mitre.org/software/S0591) can take screenshots on remote hosts.(Citation: Anomali Static Kitten February 2021)","relationship_id":"relationship--c4d751fa-60cc-4254-9737-d7df6518eabe","references":[{"source_name":"Anomali Static Kitten February 2021","description":"Mele, G. et al. (2021, February 10). Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies. Retrieved March 17, 2021.","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}]},{"id":"S0592","name":"RemoteUtilities","url":"https://attack.mitre.org/software/S0592","kind":"tool","description":"[RemoteUtilities](https://attack.mitre.org/software/S0592) can take screenshots on a compromised host.(Citation: Trend Micro Muddy Water March 2021)","relationship_id":"relationship--eb2f2175-9c0f-4217-b5da-7e29b882e4e2","references":[{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"id":"S0593","name":"ECCENTRICBANDWAGON","url":"https://attack.mitre.org/software/S0593","kind":"malware","description":"[ECCENTRICBANDWAGON](https://attack.mitre.org/software/S0593) can capture screenshots and store them locally.(Citation: CISA EB Aug 2020)","relationship_id":"relationship--8852f9e4-c2f1-4d24-8bc6-8539ec4180a5","references":[{"source_name":"CISA EB Aug 2020","description":"Cybersecurity and Infrastructure Security Agency. (2020, August 26). MAR-10301706-1.v1 - North Korean Remote Access Tool: ECCENTRICBANDWAGON. Retrieved March 18, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can take screenshots on a compromised host by calling a series of APIs.(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)","relationship_id":"relationship--d0eaa321-d917-4dee-aca4-6644ed2df1df","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) has the ability to capture screenshots.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--ac773743-8f22-4193-a2de-b562e7a13709","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) can capture screenshots of the infected machine.(Citation: Cybereason Chaes Nov 2020)","relationship_id":"relationship--e8a1c5ce-e02f-44f6-939d-a77378f06890","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0633","name":"Sliver","url":"https://attack.mitre.org/software/S0633","kind":"tool","description":"[Sliver](https://attack.mitre.org/software/S0633) can take screenshots of the victim’s active display.(Citation: GitHub Sliver Screen)","relationship_id":"relationship--8bcc4714-800c-4d13-8b85-2bdf107f5fb4","references":[{"source_name":"GitHub Sliver Screen","description":"BishopFox. (n.d.). Sliver Screenshot. Retrieved September 16, 2021.","url":"https://github.com/BishopFox/sliver/blob/master/implant/sliver/screen/screenshot_windows.go"}]},{"id":"S0643","name":"Peppy","url":"https://attack.mitre.org/software/S0643","kind":"malware","description":"[Peppy](https://attack.mitre.org/software/S0643) can take screenshots on targeted systems.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--6c10bd99-6932-451d-b739-13adf1276a22","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) can capture a screenshot of the current screen.(Citation: Talos Oblique RAT March 2021)\n","relationship_id":"relationship--18ed716d-2865-4a7a-98f8-915f07c183dc","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) has the ability to take screenshots.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--3982f2f1-8fdd-4ccd-84e6-6a13c919c4c9","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0649","name":"SMOKEDHAM","url":"https://attack.mitre.org/software/S0649","kind":"malware","description":"[SMOKEDHAM](https://attack.mitre.org/software/S0649) can capture screenshots of the victim’s desktop.(Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)","relationship_id":"relationship--b8bab261-69f2-49b4-83df-c2f8997753b1","references":[{"source_name":"FireEye Shining A Light on DARKSIDE May 2021","description":"FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"},{"source_name":"FireEye SMOKEDHAM June 2021","description":"FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can capture screenshots that are initially saved as ‘scr.jpg’.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--fdde7cd5-dd87-4280-b2df-6bd01fae8ea6","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--e43ab91c-ad83-4469-8a8f-ce3337cdcb12","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) saves a screen capture of the victim's system with a numbered filename and <code>.jpg</code> extension. Screen captures are taken at specified intervals based on the system. (Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--f53a225d-093b-4d90-9916-1e5981dbf95a","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to capture screenshots.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--1957974e-1995-4d35-a32b-e355ae219ff8","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can capture screenshots from a compromised host.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--4ea07638-aca6-400b-9979-26b9002e990c","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) has the ability to capture screenshots.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--9069440f-f2d0-4548-94a8-6759a31b1425","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) has the ability to capture screenshots.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--9532ee14-8d66-41c1-855a-209fbb3ee3af","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) has the ability to capture screenshots.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--dde11422-660a-42b1-b231-fb2fd98ed644","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) can take system screenshots and save them to `%AppData%`.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--516fd2f8-a709-43f4-86e1-c753e28113e1","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can take JPEG screenshots of an infected system.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021) [Lizar](https://attack.mitre.org/software/S0681) has also used a plugin to take a screenshot of the infected system.(Citation: BiZone Lizar May 2021) ","relationship_id":"relationship--638b21af-b5d5-44dd-9d14-ea3c2be3eb4e","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Threatpost Lizar May 2021","description":"Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}]},{"id":"S0686","name":"QuietSieve","url":"https://attack.mitre.org/software/S0686","kind":"malware","description":"[QuietSieve](https://attack.mitre.org/software/S0686) has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\\SymbolSourceSymbols\\icons` or `Temp\\ModeAuto\\icons`.(Citation: Microsoft Actinium February 2022)","relationship_id":"relationship--f7e3c06d-61a2-4008-89af-4380e7d71ced","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can take a screenshot of the current desktop.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--494a0c44-2822-4f53-977e-f36a949d8258","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.(Citation: ESET DazzleSpy Jan 2022)(Citation: Objective-See MacMa Nov 2021)","relationship_id":"relationship--2fb2a011-a35a-403a-a86b-d5489b1fa5c6","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"},{"source_name":"Objective-See MacMa Nov 2021","description":"Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.","url":"https://objective-see.org/blog/blog_0x69.html"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) has the ability to take screen captures.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--7e1ace47-17af-4291-b5f1-6b3c64c8ea6d","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"The [FunnyDream](https://attack.mitre.org/software/S1044) ScreenCap component can take screenshots on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--91718be6-b03a-48fd-a1ab-a54d7148ffa2","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) can take screen shots of a compromised machine.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--1f7e10b8-f8ea-4731-af67-7201452d32be","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can take and save screenshots.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--77c31f47-883a-4381-a70e-96bd5f1371d3","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can take a screenshot of the target machine and save it to a file.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--89574823-b59e-4a8e-87b1-8bbb9531b603","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can take screenshots on compromised hosts.(Citation: Palo Alto Brute Ratel July 2022)","relationship_id":"relationship--4f8e76b5-603e-4557-8635-465d988a4072","references":[{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can take a screenshot from an infected host.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--77fd0c13-d101-438a-a3fb-dfdcaa6e21ce","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) has the ability to take a screenshot of the infected host desktop using Windows GDI+.(Citation: MalwareBytes WoodyRAT Aug 2022) ","relationship_id":"relationship--85fda77f-5129-4de7-bc44-f81ccc46f6d9","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can take screenshots and send them to an actor-controlled C2 server.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--33fb5b08-700d-4c29-a971-c7493b904d1a","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) has the ability to view the screen on compromised hosts.(Citation: AsyncRAT GitHub)","relationship_id":"relationship--ed592480-2e4d-4604-aa8d-89bf58d72f6b","references":[{"source_name":"AsyncRAT GitHub","description":"Nyan-x-Cat. (n.d.). NYAN-x-CAT / AsyncRAT-C-Sharp. Retrieved October 3, 2023.","url":"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/README.md"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--9ae45b84-016d-4617-a4fd-3a309dc94b57","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1107","name":"NKAbuse","url":"https://attack.mitre.org/software/S1107","kind":"malware","description":"[NKAbuse](https://attack.mitre.org/software/S1107) can take screenshots of the victim machine.(Citation: NKAbuse SL)","relationship_id":"relationship--f3bfd1b7-84df-4832-87f1-12a5413eb008","references":[{"source_name":"NKAbuse SL","description":"KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.","url":"https://securelist.com/unveiling-nkabuse/111512/"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) has the ability to capture screenshots on compromised hosts.(Citation: SCILabs Malteiro 2021)(Citation: SCILabs URSA/Mispadu Evolution 2023)(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: Metabase Q Mispadu Trojan 2023) ","relationship_id":"relationship--2723c701-96d8-44e9-96ce-34c57e50a68e","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"Metabase Q Mispadu Trojan 2023","description":"Garcia, F., Regalado, D. (2023, March 7). Inside Mispadu massive infection campaign in LATAM. Retrieved March 15, 2024.","url":"https://www.metabaseq.com/mispadu-banking-trojan/"},{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"},{"source_name":"SCILabs URSA/Mispadu Evolution 2023","description":"SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/evolution-of-banking-trojan-ursa-mispadu/"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can capture screenshots from compromised hosts.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--c4f4e2ba-5ad8-4787-8d69-cc6720619ac9","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) can capture screenshots from victim systems.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--a6f8439f-bf5a-4e57-8ae5-758e5097a0ff","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can capture screenshots on targeted systems using a timer and either upload them or store them to disk.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--ce9f3239-13ee-4741-b839-8e7c68d5f9ef","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can run `screencapture` to collect screenshots from compromised hosts. (Citation: Kandji Cuckoo April 2024)","relationship_id":"relationship--57733df2-7d2d-470a-afbb-8f48b7c53821","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1156","name":"Manjusaka","url":"https://attack.mitre.org/software/S1156","kind":"malware","description":"[Manjusaka](https://attack.mitre.org/software/S1156) can take screenshots of the victim desktop.(Citation: Talos Manjusaka 2022)","relationship_id":"relationship--831afa86-aa1b-42d9-8c67-1c03f5879a42","references":[{"source_name":"Talos Manjusaka 2022","description":"Asheer Malhotra & Vitor Ventura. (2022, August 2). Manjusaka: A Chinese sibling of Sliver and Cobalt Strike. Retrieved September 4, 2024.","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can capture screenshots.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--5b6293d5-f49c-4dbe-bef3-73bb346c3fe4","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) uses Apple's built-in AVFoundation Framework library to access the user's camera and screen. It uses the `AVCaptureStillImage` to take a picture using the user's camera and the `AVCaptureScreen` to take a screenshot or record the user's screen for a specified period of time.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--357dc150-9787-4b39-b18a-a0a38778a44f","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1196","name":"Troll Stealer","url":"https://attack.mitre.org/software/S1196","kind":"malware","description":"[Troll Stealer](https://attack.mitre.org/software/S1196) can capture screenshots from victim machines.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--1557ceea-6626-41ab-935f-ae0f96723184","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has the ability to capture screenshots of new browser tabs, based on the presence of the `Capture` flag.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--924b50a5-3fae-496c-8167-610fa261a10f","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can capture screenshots on compromised hosts.(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)","relationship_id":"relationship--0eda9c73-fcf0-4796-8000-8dfea88887f4","references":[{"source_name":"Netskope XLoader 2022","description":"Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"},{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}]},{"id":"S1209","name":"Quick Assist","url":"https://attack.mitre.org/software/S1209","kind":"tool","description":"[Quick Assist](https://attack.mitre.org/software/S1209) allows for the remote administrator to take screenshots of the running system.(Citation: Microsoft Quick Assist 2024)","relationship_id":"relationship--67731257-6a0a-46cf-8f7e-cc6793d5fdb9","references":[{"source_name":"Microsoft Quick Assist 2024","description":"Microsoft. (2024, September 4). Use Quick Assist to help users. Retrieved March 14, 2025.","url":"https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has taken screenshots of victim machines.(Citation: Cybereason LumaStealer Undated)","relationship_id":"relationship--1e86ff72-2edc-4924-9f05-7e559b54ac82","references":[{"source_name":"Cybereason LumaStealer Undated","description":"Cybereaon Security Services Team. (n.d.). Your Data Is Under New Lummanagement: The Rise of LummaStealer. Retrieved March 22, 2025.","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can capture screenshots.(Citation: Havoc Framework Documentation)(Citation: Zscaler Havoc FEB 2023)(Citation: Immersive Labs Havoc C2 APR 2024)","relationship_id":"relationship--3a0a1c4d-2b99-4c72-9aa1-d002c403ee63","references":[{"source_name":"Immersive Labs Havoc C2 APR 2024","description":"Immersive Content Team. (2024, April 9). Havoc C2 Framework – A Defensive Operator’s Guide. Retrieved August 13, 2025.","url":"https://www.immersivelabs.com/resources/blog/havoc-c2-framework-a-defensive-operators-guide"},{"source_name":"Zscaler Havoc FEB 2023","description":"Shivtarkar, N. and Jain, S. (2023, February 14). Havoc Across the Cyberspace. Retrieved August 4, 2025.","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has conducted screen capturing.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023) ","relationship_id":"relationship--177772b9-329e-4c43-95ed-f9ce99ae250c","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) can capture screenshots on a compromised host.(Citation: McAfee RedLine Stealer April 2024)(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--536cdc1b-65c7-4236-8e2a-b0093495c9d9","references":[{"source_name":"McAfee RedLine Stealer April 2024","description":"Mohansundaram M, Neil Tyagi. (2024, April 17). Redline Stealer: A Novel Approach. Retrieved September 17, 2025.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"},{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S9007","name":"HTTPTroy","url":"https://attack.mitre.org/software/S9007","kind":"malware","description":"[HTTPTroy](https://attack.mitre.org/software/S9007) has obtained screen captures leveraging the `screen` command which captures, encrypts and uploads the stolen image to the adversary controlled C2 server.(Citation: Gen Digital Kimsuky HTTPTroy October 2025)","relationship_id":"relationship--7cd4244c-38ef-4396-a76d-0450b7f1a651","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) has the ability to take screenshots.(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--6dbdaa06-8c0c-4b74-8274-1adbd80d0940","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"The [AshTag](https://attack.mitre.org/software/S9031) AshenOrchestrator component has the ability to take screenshots.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--00cd22e3-0291-45e8-9d05-e3243f5d9eee","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9058","name":"SIGHTGRAB","url":"https://attack.mitre.org/software/S9058","kind":"malware","description":"[SIGHTGRAB](https://attack.mitre.org/software/S9058) has captured screenshots of victim devices and has saved them incrementally within created folders.(Citation: Mandiant_UNC1549_Nov2025)   ","relationship_id":"relationship--e6bdbd69-aa50-4540-9706-d91ca2de72d0","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used tools to take screenshots from victims.(Citation: ESET Sednit Part 2)(Citation: XAgentOSX 2017)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)","relationship_id":"relationship--48f662fe-1ba2-4c19-b782-dd06d9fb67fa","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"},{"source_name":"Secureworks IRON TWILIGHT Active Measures March 2017","description":"Secureworks CTU. (2017, March 30). IRON TWILIGHT Supports Active Measures. Retrieved February 28, 2022.","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--08b30f76-ca12-4d2c-9345-ee51bfd54e9f","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source_name":"Symantec Dragonfly Sept 2017","description":"Symantec Security Response. (2014, July 7). Dragonfly: Western energy sector targeted by sophisticated attack group. Retrieved September 9, 2017.","url":"https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"},{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"G0043","name":"Group5","url":"https://attack.mitre.org/groups/G0043","kind":"intrusion-set","description":"Malware used by [Group5](https://attack.mitre.org/groups/G0043) is capable of watching the victim's screen.(Citation: Citizen Lab Group5)","relationship_id":"relationship--8e69c855-db70-4b5e-866b-f9ce0b786156","references":[{"source_name":"Citizen Lab Group5","description":"Scott-Railton, J., et al. (2016, August 2). Group5: Syria and the Iranian Connection. Retrieved September 26, 2016.","url":"https://citizenlab.ca/2016/08/group5-syria/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018)","relationship_id":"relationship--f443e72c-68a6-4d46-b2aa-96b1aafd5f6b","references":[{"source_name":"DOJ FIN7 Aug 2018","description":"Department of Justice. (2018, August 01). HOW FIN7 ATTACKED AND STOLE DATA. Retrieved August 24, 2018.","url":"https://www.justice.gov/opa/press-release/file/1084361/download"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047)'s malware can take screenshots of the compromised computer every minute.(Citation: ESET Gamaredon June 2020)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024)   \t","relationship_id":"relationship--3a9117f6-9244-4d09-a69b-43afbb4d2998","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has a tool called CANDYKING to capture a screenshot of user's desktop.(Citation: FireEye APT34 Webinar Dec 2017)","relationship_id":"relationship--45cd89d8-68fd-42a2-94ba-7796a696bc47","references":[{"source_name":"FireEye APT34 Webinar Dec 2017","description":"Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware can take a screenshot and upload the file to its C2 server.(Citation: Unit 42 Magic Hound Feb 2017)","relationship_id":"relationship--65f7704a-358a-464d-b09b-fee5dd96adf3","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used a tool to capture screenshots.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--2d840d1b-28d7-4387-86fd-6d3df8650171","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)","relationship_id":"relationship--6f6b8a04-916e-4f33-8837-ff48e00e771b","references":[{"source_name":"Securelist MuddyWater Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.","url":"https://securelist.com/muddywater/88059/"}]},{"id":"G0070","name":"Dark Caracal","url":"https://attack.mitre.org/groups/G0070","kind":"intrusion-set","description":"[Dark Caracal](https://attack.mitre.org/groups/G0070) took screenshots using their Windows malware.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--ec8f73de-eab1-4d3b-88c0-7885716aa748","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--932beba4-bb6a-4174-abe3-353d2e39337c","references":[{"source_name":"Symantec Chafer February 2018","description":"Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) can capture victim screen activity.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)","relationship_id":"relationship--778765e1-7eb6-46b1-a370-6dfe09081ee3","references":[{"source_name":"SecureList Silence Nov 2017","description":"GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has captured browser screenshots using [TRANSLATEXT](https://attack.mitre.org/software/S1201).(Citation: Zscaler Kimsuky TRANSLATEXT) [Kimsuky](https://attack.mitre.org/groups/G0094) has also obtained screen captures with custom malware.(Citation: Gen Digital Kimsuky HTTPTroy October 2025) ","relationship_id":"relationship--bf53c414-9ea5-4f56-8f73-eb7d2287f651","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.(Citation: Tetra Defense Sodinokibi March 2020)","relationship_id":"relationship--513f6b4c-c9b1-4339-910e-376b2a908689","references":[{"source_name":"Tetra Defense Sodinokibi March 2020","description":"Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--77fcf452-80a6-4922-99fa-896fe68a8c8a","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1019","name":"MoustachedBouncer","url":"https://attack.mitre.org/groups/G1019","kind":"intrusion-set","description":"[MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used plugins to take screenshots on targeted systems.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--4deeafce-daf7-4dc8-a949-80eaf086ca0e","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) delivered PowerShell scripts capable of taking screenshots of victim machines.(Citation: CERT-UA WinterVivern 2023)","relationship_id":"relationship--71cd5162-6352-4e19-9a02-2d8510333f6a","references":[{"source_name":"CERT-UA WinterVivern 2023","description":"CERT-UA. (2023, February 1). UAC-0114 aka Winter Vivern to target Ukrainian and Polish GOV entities (CERT-UA#5909). Retrieved July 29, 2024.","url":"https://cert.gov.ua/article/3761104"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has used malware, such as GHAMBAR and POWERPOST, to take screenshots.(Citation: Mandiant APT42-charms) ","relationship_id":"relationship--58d20f74-b41a-45c3-b6de-41a3d6cf86e0","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has captured screen content during an active Zoom session.(Citation: FBI IC3 Flash VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--05119f3a-ad4c-41a8-b4af-10813f657437","references":[{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","description":"FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to  Push Malware to Identified Targets. Retrieved April 20, 2026.","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]}],"mitigations":[],"candidates":[{"id":"0f47ceb1-720f-4275-96b8-21f0562217ac","name":"Screencapture","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use screencapture command to collect a full desktop screenshot\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.png"}},"dependencies":[],"source_definition_sha256":"d4881670fbab716bddfb5272168e5f85195d5aaaa797c1c9504b81e2a539e45e"},{"id":"18397d87-38aa-4443-a098-8a48a8ca5d8d","name":"Capture Linux Desktop using Import Tool (freebsd)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use import command from ImageMagick to collect a full desktop screenshot\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.png"}},"dependencies":[{"description":"ImageMagick must be installed\n"}],"source_definition_sha256":"1ca458675728a506efc9458401a0c19feedd2f026e2841499b385bba3a97af5d"},{"id":"3c898f62-626c-47d5-aad2-6de873d69153","name":"Windows Screencapture","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"c:\\temp\\T1113_desktop.zip"},"recording_time":{"description":"Time to take screenshots","type":"integer","default":5}},"dependencies":[],"source_definition_sha256":"5e4c41d839ad4e737671d01802bf2ea095773e4d91246ef357806008cedcbc16"},{"id":"562f3bc2-74e8-46c5-95c7-0e01f9ccc65c","name":"X Windows Capture (freebsd)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use xwd command to collect a full desktop screenshot and review file with xwud\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.xwd"}},"dependencies":[{"description":"Package with XWD and XWUD must exist on device\n"}],"source_definition_sha256":"7e65e5ebf5c7f8767d28a38adda7a7bb05d02f1b22f7f7ac2e885729ed865e5c"},{"id":"5a496325-0115-4274-8eb9-755b649ad0fb","name":"Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing \"DisableAIDataAnalysis\" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. \n- https://learn.microsoft.com/en-us/windows/client-management/manage-recall\n- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis","inputs":{},"dependencies":[],"source_definition_sha256":"86c5d355803590e9fa48d5d17539b1ab4acaeed93416074641c6788d5a0be665"},{"id":"8206dd0c-faf6-4d74-ba13-7fbe13dce6ac","name":"X Windows Capture","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use xwd command to collect a full desktop screenshot and review file with xwud\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.xwd"},"package_checker":{"description":"Package checking command for linux. Debian system command- dpkg -s x11-apps","type":"string","default":"rpm -q xorg-x11-apps"},"package_installer":{"description":"Package installer command for linux. Debian system command- apt-get install x11-apps","type":"string","default":"yum install -y xorg-x11-apps"}},"dependencies":[{"description":"Package with XWD and XWUD must exist on device\n"}],"source_definition_sha256":"3a6872b18b4c6ff001f71bcc824ed4d9d2373ee54561ece6f30fc0721717095a"},{"id":"98f19852-7348-4f99-9e15-6ff4320464c7","name":"RDP Bitmap Cache Extraction via bmc-tools","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Simulates an attacker extracting the RDP bitmap cache using the ANSSI \"bmc-tools.py\" script.\nThis test requires valid RDP bitmap cache files to exist on the system (usually created after an outgoing RDP connection is made).\n","inputs":{"cache_path":{"description":"Path to the RDP Cache directory or specific .bmc file","type":"path","default":"$env:LOCALAPPDATA\\Microsoft\\Terminal Server Client\\Cache"},"output_dir":{"description":"Directory to save reconstructed images","type":"path","default":"$env:TEMP\\rdp_screens"}},"dependencies":[{"description":"Python must be installed and in the PATH to run bmc-tools.py\n"}],"source_definition_sha256":"11503bb77bde64a10dad0667d72aeb4f0cf217f777eb67c2ed56426aa42d7ab5"},{"id":"9cd1cccb-91e4-4550-9139-e20a586fcea1","name":"Capture Linux Desktop using Import Tool","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use import command from ImageMagick to collect a full desktop screenshot\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.png"}},"dependencies":[{"description":"ImageMagick must be installed\n"}],"source_definition_sha256":"b4c2d430705268552731ebdd3b570f79e0bb624f6cca8357e9ffe47868c5117a"},{"id":"deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4","name":"Screencapture (silent)","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Use screencapture command to collect a full desktop screenshot\n","inputs":{"output_file":{"description":"Output file path","type":"path","default":"/tmp/T1113_desktop.png"}},"dependencies":[],"source_definition_sha256":"643735c7d2e81c8e9ecbeee3d54b10ffdbefa519df9240a95454b6ad2e47bafd"},{"id":"e9313014-985a-48ef-80d9-cde604ffc187","name":"Windows Screen Capture (CopyFromScreen)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1113/T1113.yaml","description":"Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.\n[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen\n","inputs":{"output_file":{"description":"Path where captured results will be placed","type":"path","default":"$env:TEMP\\T1113.png"}},"dependencies":[],"source_definition_sha256":"b57a81bea61e73b1fe1c62d3af9d9d704f707fe2c26391f23cc5ac9af49ffece"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1113":"/ttp-simulation/techniques/enterprise/T1113/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1113","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}