EvilBunny

“Using the stolen credentials and their detailed knowledge of the bank’s SWIFT operations, the attackers composed and transmitted 35 fraudulent payment instructions through Bangladesh Bank’s SWIFT terminal.”

“Initial access was achieved through a spear-phishing email carrying a weaponized document (likely a .doc or .rtf file exploiting a known CVE in Microsoft Office).”

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

“Upon execution, the payload dropped a first-stage loader that established persistence via registry run keys and scheduled tasks.”

Several entries refer generically to command-line interfaces, shell commands, scripting engines, or script execution without always specifying the exact interpreter.

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

“[The] weaponized document [was] likely a .doc or .rtf file exploiting a known CVE in Microsoft Office.”

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

“Upon execution, the payload dropped a first-stage loader that established persistence via registry run keys and scheduled tasks.”

“Using the stolen credentials and their detailed knowledge of the bank’s SWIFT operations, the attackers composed and transmitted 35 fraudulent payment instructions through Bangladesh Bank’s SWIFT terminal.”

“Upon execution, the payload dropped a first-stage loader that established persistence via registry run keys and scheduled tasks.”

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

“Upon execution, the payload dropped a first-stage loader that established persistence via registry run keys and scheduled tasks.”

“Using the stolen credentials and their detailed knowledge of the bank’s SWIFT operations, the attackers composed and transmitted 35 fraudulent payment instructions through Bangladesh Bank’s SWIFT terminal.”

“Upon execution, the payload dropped a first-stage loader that established persistence via registry run keys and scheduled tasks.”

Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

“Using the stolen credentials and their detailed knowledge of the bank’s SWIFT operations, the attackers composed and transmitted 35 fraudulent payment instructions through Bangladesh Bank’s SWIFT terminal.”

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.

“[The] second-stage backdoor [was] capable of keylogging, screen capture, file exfiltration, and arbitrary command execution.”

“During this window, the intruders mapped the bank’s internal network topology [and] identified workstations connected to the SWIFT Alliance system.”

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

Examples include 'Action RAT can use WMI to gather AV products installed on an infected host,' 'Bumblebee can use WMI to gather system information,' and 'Volt Typhoon has leveraged WMIC for execution, remote system discovery.'

The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

“[The] second-stage backdoor [was] capable of keylogging, screen capture, file exfiltration, and arbitrary command execution.”

“[The] second-stage backdoor [was] capable of keylogging, screen capture, file exfiltration, and arbitrary command execution.”

“Network traffic analysis showed the malware communicating with C2 servers over HTTPS using self-signed certificates.”

“[The malware used] fallback channels over DNS tunneling for environments where direct outbound connections were restricted.”

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

“The encryption used for C2 communications was a custom implementation of AES-128 in CBC mode with a hardcoded key derivation function.”

“[The] second-stage backdoor [was] capable of keylogging, screen capture, file exfiltration, and arbitrary command execution.”

“The SWIFT-specific component… could suppress confirmation messages [and] alter transaction records.”

“The attackers composed and transmitted 35 fraudulent payment instructions… to transfer a combined $951 million to accounts across Asia.”

“This printer, which normally produced real-time hard copies of all transaction confirmations, was deliberately crashed… meant to blind the bank’s internal monitoring during the 72-hour window.”