Kimsuky has used e-mail to send exfiltrated data to C2 servers.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.(Citation: CISA AA20-301A Kimsuky)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1557|Adversary-in-the-Middle|

Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Kimsuky has gathered credentials using

Mimikatz and ProcDump.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|