Threat Group-3390 has downloaded additional malware and tools, including through the use of

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.(Citation: Dell TG-3390)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.

Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.(Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

Threat Group-3390 actors use

at to schedule tasks to run self-extracting RAR archives, which install

HTTPBrowser or

PlugX on other victims on a network.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as