APT28 has used pass the hash for lateral movement.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1025|Data from Removable Media|An

APT28 backdoor may collect the entire contents of an inserted USB device.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT28 has stored captured credential information in a file named pi.log.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1092|Communication Through Removable Media|

APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.(Citation: Microsoft SIR Vol 19)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1546.015|Component Object Model Hijacking|

APT28 has used COM hijacking for persistence by replacing the legitimate

APT28 has used tools to take screenshots from victims.(Citation: ESET Sednit Part 2)(Citation: XAgentOSX 2017)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

APT28 regularly deploys both publicly available (ex: