FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.(Citation: FireEye FIN10 June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.(Citation: FireEye FIN10 June 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

FIN10 has used RDP to move laterally to systems in the victim environment.(Citation: FireEye FIN10 June 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

FIN10 has executed malicious .bat files containing PowerShell commands.(Citation: FireEye FIN10 June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

FIN10 has used Meterpreter to enumerate users on remote systems.(Citation: FireEye FIN10 June 2017)|