Threat Group-3390 has obtained and used tools such as

Impacket,

pwdump,

Mimikatz,

gsecdump,

NBTscan, and

Windows Credential Editor.(Citation: Unit42 Emissary Panda May 2019)(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.002|Upload Tool|

Threat Group-3390 has staged tools, including

gsecdump and WCE, on previously compromised websites.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.(Citation: Gallagher 2015)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Threat Group-3390 actors have used a modified version of

Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with

China Chopper prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|