NBTscan to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Tonto Team has used a variety of credential dumping tools.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Tonto Team has used Python-based tools for execution.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Tonto Team has used keylogging tools in their operations.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Tonto Team has used EternalBlue exploits for lateral movement.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.001|Local Groups|

Tonto Team has used the

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Tonto Team has used PowerShell to download additional payloads.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Tonto Team has downloaded malicious DLLs which served as a

ShadowPad loader.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|