HEXANE has used a VisualBasic script named

HEXANE has used a

Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.001|Local Groups|

HEXANE has run

HEXANE has run

HEXANE has run

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

HEXANE has used Base64-encoded scripts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1608.001|Upload Malware|

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1585.001|Social Media Accounts|

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Office 365,SaaS,Google Workspace|T1534|Internal Spearphishing|

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1589|Gather Victim Identity Information|