APT39 has used SQL injection for initial compromise.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

APT39 has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT39 has used tools for capturing keystrokes.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT39 has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1115|Clipboard Data|

APT39 has used tools capable of stealing contents of the clipboard.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT39 has downloaded tools to compromised hosts.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT39 has used SMB for lateral movement.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

APT39 has used different versions of Mimikatz to obtain credentials.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|