Meta tags:

Headings (most frequently used words):

screen, capture, procedure, examples, mitigations, detection, strategy, references,

Text of the page (most frequently used words):
retrieved (234), the (190), screenshots (122), and (111), 2018 (86), can (79), #capture (65), has (59), 2017 (58), take (58), 2021 (56), 2020 (55), november (51), april (51), march (47), screen (47), 2019 (42), may (42), 2024 (42), september (41), february (40), june (40), malware (39), new (37), 2022 (37), victim (35), august (33), july (33), december (30), october (28), screenshot (26), january (25), captures (25), ability (24), analysis (23), 2025 (23), desktop (23), 2016 (22), group (22), with (22), rat (22), cyber (21), campaign (21), threat (21), from (20), used (19), using (19), compromised (19), team (17), machine (17), 2026 (16), system (16), operation (15), stealer (15), for (15), 2023 (14), targets (14), espionage (13), targeting (13), apt (13), host (13), backdoor (12), trojan (12), infected (12), them (12), all (11), security (11), research (11), attacks (11), that (11), capable (11), att (10), variant (10), target (10), government (10), middle (10), based (10), windows (10), techniques (9), global (9), attack (9), tool (9), command (9), hosts (9), server (9), user (9), are (8), data (8), falcone (8), phishing (8), korean (8), uses (8), targeted (8), fin7 (8), takes (8), enterprise (7), campaigns (7), iranian (7), kimsuky (7), 2014 (7), remote (7), east (7), continues (7), tools (7), machines (7), taking (7), capturing (7), every (7), use (6), ics (6), mobile (6), eset (6), intelligence (6), cert (6), access (6), back (6), energy (6), symantec (6), toolkit (6), sector (6), against (6), kaspersky (6), rokrat (6), version (6), gamaredon (6), netwire (6), systems (6), agent (6), tesla (6), captured (6), 2015 (5), none (5), panda (5), framework (5), south (5), asia (5), response (5), entities (5), 2013 (5), cyberespionage (5), great (5), ransomware (5), organizations (5), fireeye (5), north (5), muddywater (5), victims (5), its (5), part (5), unit (5), evolution (5), powersploit (5), mispadu (5), cobalt (5), strike (5), macos (5), machete (5), under (5), havoc (5), also (5), apis (5), jpg (5), perform (5), mitre (4), tactics (4), zebrocy (4), lee (4), modular (4), through (4), cloud (4), mac (4), into (4), actors (4), compromise (4), infrastructure (4), iran (4), ukraine (4), updates (4), latest (4), apt10 (4), signed (4), dragonfly (4), grunzweig (4), lunghi (4), operations (4), mar (4), sliver (4), silence (4), banking (4), mercer (4), actor (4), remexi (4), spy (4), diplomatic (4), redline (4), eastern (4), raccoon (4), octopus (4), lodeinfo (4), translatext (4), api (4), invisimole (4), spyware (4), content (4), finfisher (4), activity (4), temp (4), bronze (4), butler (4), active (4), screencapture (4), image (4), taken (4), contains (4), png (4), send (4), save (4), minutes (4), plugin (4), seconds (4), module (4), open (4), software (3), cti (3), components (3), detection (3), mitigations (3), defenses (3), sub (3), core (3), zeus (3), cisa (3), report (3), sofacy (3), leverages (3), delivered (3), xcsset (3), malicious (3), code (3), exploits (3), woody (3), feature (3), aka (3), winter (3), vivern (3), critical (3), fbi (3), lancaster (3), vermin (3), custom (3), valak (3), ursnif (3), earth (3), spear (3), japanese (3), sectors (3), turian (3), troll (3), karagany (3), tajmahal (3), t9000 (3), advanced (3), sysupdate (3), strifewater (3), lab (3), stonedrill (3), attacking (3), out (3), darkside (3), slothfulmedia (3), silenttrinity (3), financial (3), hacking (3), faou (3), rtm (3), rover (3), technique (3), rascagneres (3), chafer (3), foreign (3), zhang (3), remcos (3), exploit (3), cross (3), novel (3), redleaves (3), oilrig (3), center (3), ramsay (3), vrabie (3), military (3), microsoft (3), quick (3), assist (3), cherepanov (3), powerstats (3), post (3), powershell (3), poetrat (3), plugx (3), central (3), obliquerat (3), nkabuse (3), njrat (3), moustachedbouncer (3), micropsia (3), metamorfo (3), years (3), manjusaka (3), chinese (3), magic (3), hound (3), macma (3), lookback (3), since (3), lightspy (3), konni (3), keymarble (3), kazuar (3), files (3), kasidet (3), jrat (3), janicab (3), hydraq (3), httptroy (3), group5 (3), gh0st (3), flame (3), eccentricbandwagon (3), dogcall (3), daserf (3), cuckoo (3), like (3), transparent (3), tribe (3), cosmicduke (3), cobian (3), chaes (3), catchamas (3), cardinal (3), over (3), carberp (3), carbanak (3), cannon (3), when (3), browser (3), bandook (3), dark (3), caracal (3), badpatch (3), badnews (3), badhatch (3), azorult (3), commands (3), attor (3), asyncrat (3), ashtag (3), apt42 (3), cadelspy (3), xagentosx (3), appleseed (3), copyfromscreen (3), obtain (3), format (3), obtained (3), gdi32 (3), dll (3), during (3), file (3), applications (3), display (3), current (3), saved (3), then (3), such (3), lizar (3), capability (3), component (3), connectwise (3), corporation (2), domains (2), resources (2), reference (2), groups (2), analytics (2), strategies (2), assets (2), matrices (2), objects (2), apt41 (2), dust (2), accenture (2), land (2), sednit (2), schwarz (2), formbook (2), google (2), performs (2), two (2), ukrainian (2), persistent (2), flash (2), deploy (2), salem (2), more (2), breitenbacher (2), mirrorface (2), anel (2), hiroaki (2), recent (2), kasha (2), ttps (2), updated (2), insights (2), ties (2), hunter (2), linux (2), s2w (2), distribute (2), secureworks (2), robert (2), asian (2), linked (2), cylance (2), sophisticated (2), complex (2), anti (2), iron (2), patrick (2), cybereason (2), nocturnus (2), adds (2), saudi (2), patchwork (2), mission (2), abuses (2), services (2), arsenal (2), platforms (2), harbison (2), russian (2), boutin (2), manual (2), guide (2), indian (2), jazi (2), apt37 (2), pantazopoulos (2), reloaded (2), defense (2), not (2), detections (2), steganography (2), network (2), naikon (2), depth (2), users (2), russia (2), bear (2), toolset (2), surveillance (2), apt34 (2), suspected (2), multi (2), stage (2), exploitation (2), 2012 (2), cybersecurity (2), computer (2), incident (2), malhotra (2), returns (2), multiplatform (2), latin (2), america (2), removable (2), dissecting (2), process (2), behind (2), latam (2), scilabs (2), this (2), metador (2), technical (2), appendix (2), labs (2), clearsky (2), kitten (2), wardle (2), osx (2), deploys (2), venezuelan (2), institutions (2), rise (2), united (2), states (2), utilities (2), engineering (2), threats (2), pentest (2), ethical (2), levene (2), yadav (2), gostev (2), platform (2), conflict (2), real (2), playbook (2), thomas (2), called (2), hromcova (2), lazarus (2), carbon (2), black (2), operator (2), allievi (2), tricks (2), other (2), reaper (2), industries (2), chen (2), infostealer (2), strategic (2), llc (2), check (2), point (2), information (2), stealing (2), plugins (2), abuse (2), mandiant (2), old (2), found (2), nyan (2), cat (2), drop (2), xwd (2), parent (2), processes (2), built (2), disk (2), calls (2), analytic (2), description (2), name (2), zxshell (2), zlib (2), jpeg (2), bmp (2), yty (2), xloader (2), saves (2), specified (2), intervals (2), volt (2), typhoon (2), void (2), manticore (2), uppercut (2), turnedup (2), 102 (2), toneshell (2), functionality (2), tinyzbot (2), including (2), application (2), svcready (2), socksbot (2), smokedham (2), named (2), local (2), shutterspeed (2), sharpstage (2), exfiltration (2), library (2), roguerobin (2), revenge (2), remoteutilities (2), rdat (2), rcsession (2), rainyday (2), five (2), icons (2), quietsieve (2), allows (2), each (2), pupy (2), pteranodon (2), proton (2), prikormka (2), powruner (2), regular (2), get (2), pooraim (2), peppy (2), pcshare (2), 135 (2), nightclub (2), calling (2), collect (2), 121 (2), metamain (2), performing (2), matryoshka (2), scr (2), markirat (2), upload (2), mafalda (2), macspy (2), apple (2), lunarmail (2), lumma (2), 108 (2), litepower (2), camera (2), time (2), kivars (2), keyboy (2), jhuhugit (2), sent (2), window (2), hyperbro (2), live (2), which (2), controlled (2), hotcroissant (2), halfbaked (2), griffon (2), gold (2), southfield (2), funnydream (2), fruitfly (2), flawedammyy (2), attempt (2), video (2), evilgrab (2), empire (2), store (2), dustysky (2), dusttrap (2), exe (2), derusbi (2), crossrat (2), crimson (2), exfiltrates (2), clambling (2), chrommme (2), chopstick (2), chimneysweep (2), charmpower (2), brute (2), ratel (2), bluelight (2), blackenergy (2), biscuit (2), aria (2), body (2), apt39 (2), apt28 (2), adversaries (2), nircmd (2), poland (2), wiper (2), t1113 (2), ckcon (2), person (2), tickets (2), faq (2), registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, fraser, double, dragonapt41, dual, crime, gross, storm, ebach, results, ar20, 303b, snakemackerel, journey, dear, joohn, what, going, sopko, donot, gustavo, palazolo, netskope, emails, nart, villeneuve, randi, eitzman, sandor, nemes, tyler, dean, significant, distribution, impacting, korea, inserts, xcode, projects, uxss, planting, safari, zero, day, malwarebytes, rich, spotted, wild, uac, 0114, polish, gov, 5909, prc, state, sponsored, maintain, 20260320, 001, telegram, push, identified, cortes, quasar, than, meets, eye, sioting, bkdr_ursnif, caragay, multifaceted, dominik, akairyū, invites, europe, expo, revives, guess, who, return, taiwan, japan, matsuda, muhammad, corporations, leary, apt33, aerospace, destructive, adam, burgher, backdoordiplomacy, upgrading, quarian, springtail, added, jiho, kim, sebin, disguised, company, valid, certificate, english, ver, suppliers, lior, rochberger, tom, fakterman, southeast, stately, taurus, mustang, cleaver, project, miller, osborn, tiger, evolved, schlapfer, loader, gets, ready, moses, staff, shamoon, wipers, beyond, untangling, smoking, affiliate, supply, chain, shining, light, dhs, national, force, 10303705, bishopfox, salvati, modules, moving, ilascu, facebook, molerats, duncan, language, malspam, pushing, redaman, read, ray, hayashi, ambassador, afghanistan, hossein, retrohunting, vba, self, decode, inject, scarcruft, evolve, introduces, bluetooth, harvester, introducing, darkhydrus, livelli, shaheen, peretz, theck, vetala, legezo, klijnsma, rats, turkish, contractors, splunk, mohansundaram, neil, tyagi, approach, hogfish, isight, menupass, manifestation, longstanding, telecommunications, organization, channel, inventory, apt27, turns, antiy, darkhotel, infiltration, isolation, traces, pierre, bourhis, quentin, bourgue, sekoia, tdr, talon, actinium, help, nicolas, verdier, primitive, actively, kasza, reichel, groundbait, sardiwal, cve, 11882, horejsi, resurfaces, singh, procedures, powershellmafia, dragos, year, review, python, covid, lures, azerbaijan, public, private, luxembourg, davis, caban, nomadic, paganini, dustsquad, infested, seas, hijacked, websites, gert, unveiling, abusing, nkn, protocol, blindeagle, flying, high, pascual, autoit, compiled, worm, affecting, media, delivers, fileless, bladabindi, proofpoint, geofenced, lambert, intro, maniath, kadam, usage, hollowing, mcafee, expands, diplomats, belarus, garcia, regalado, inside, massive, infection, advertisement, discounted, unhappy, meal, ursa, profile, malteiro, tsarfaty, casbaneiro, peculiarities, affects, brazil, mexico, sierra, iglesias, brazilian, sentinellabs, minerva, ltd, copykittens, trend, micro, wilted, tulip, exposing, apparatus, ferocious, covert, asheer, vitor, ventura, sibling, ehrlich, mystery, unattributed, hiding, telcos, isps, universities, cdds, léveillé, watering, hole, dazzlespy, kate, steals, secrets, provide, support, reactionaries, hpreact, cut, just, got, sharper, jurčacko, moon, doors, lunar, landing, missions, cybereaon, your, lummanagement, lummastealer, raggi, impersonating, licensing, boards, itochu, endless, struggle, unmasking, liberalface, political, ishimaru, tracking, down, zone, cybercriminal, disguises, hacker, seals, masquerades, yamout, wirte, living, off, least, stuart, ashenbrenner, alden, schmidt, radar, bermejo, following, trail, blacktech, park, academia, 10135536, parys, keyboys, town, office, dropping, dridex, kamluk, adwind, sharma, revamped, parsing, decoy, document, viewer, brod, right, left, override, trick, cherpanov, hidden, story, hromcová, surprisingly, equipped, undercover, emissary, sharepoint, servers, lelli, 2010, alexndru, cristian, bardas, dprk, blindingcan, knight, vmware, tau, immersive, defensive, shivtarkar, jain, across, cyberspace, ungur, carr, lnk, scott, railton, syria, connection, namestnikov, aime, infamous, cybercrime, rig, activities, tetra, cause, effect, sodinokibi, decoding, rusnák, way, shuckworm, grows, game, institute, profiling, ta505, questions, answers, flori, exposed, researcher, tale, defeating, traps, virtual, department, justice, how, attacked, stole, pwc, bae, hopper, annex, schroeder, warner, nelson, github, powershellempire, agency, 10301706, gaza, cybergang, group1, sneakypastes, mike, stokkel, arisen, slowik, baffling, berserk, decade, western, alert, ta18, 074a, nokki, almost, knot, overlooked, periscope, maritime, hsieh, redbaldknight, now, kohler, lopez, behaves, between, baisini, begins, education, dedola, huss, secure, cosmu, twist, miniduke, mele, probable, static, conducting, uae, kuwait, agencies, backdoored, penetration, testers, amnesty, international, vietnamese, activists, notorious, uncovering, drbcontrol, dupuy, gelsemium, jenkins, roadsweep, likely, conducts, politically, motivated, disruptive, albanian, apt35, log4j, vulnerability, american, commerce, balanza, giuliani, 2011, bennett, vengerik, wheels, attackers, door, renals, brutal, red, teaming, being, abused, endtrade, tick, backdoors, classified, counter, enterprises, cash, meltzer, adair, inkysquid, infects, baumgartner, garnaeva, be2, router, profiles, digital, blaich, scale, bar, conant, deliver, subcontinent, settle, monsoon, fin8, improved, yan, wine, bottle, findmyname, fallout, kit, tor, communications, meet, fantasy, creature, sharp, hamas, affiliated, ashen, lepus, suite, checkpoint, crooked, charms, cons, compromises, indicators, associated, rana, computing, known, itg07, reveal, heightened, ambitions, ctu, twilight, supports, measures, mueller, indictment, viktor, borisovich, netyksho, xagent, route, observing, comings, goings, kisa, reconnaissance, resource, muzabi, arsene, oil, gas, spearphishing, advance, historic, opec, deal, net, agenttesla, digitrust, brumaghin, dog, analysing, rtf, distributing, loki, pyrebox, polska, reed, antiquated, graphics, method, references, import, generate, especially, non, gui, an0982, invocation, undocumented, suspicious, an0981, unusual, line, write, an0980, detect, via, det0346, strategy, type, cannot, easily, mitigated, preventive, controls, features, 234, s0412, 233, s0086, 232, s0330, 231, 230, 229, 228, 227, s0251, collects, 226, s0248, 225, 224, s1207, numbered, filename, extension, 223, s0658, takescreenshot, along, starttakescreenshot, stoptakescreenshot, functions, cggetactivedisplaylist, cgdisplaycreateimage, nsimage, initwithcgimage, methods, s0161, gdi, 222, s1065, scripts, 221, g1035, gdiplus, libraries, 220, g1017, zoom, session, 219, g1055, 218, s0257, 217, s0476, hooked, 216, 215, s0386, 214, 213, 212, 211, s0275, 210, s0199, 209, s0647, 208, 207, s1196, 206, 205, programdata, mail, mailag, shot, s0094, tabs, presence, flag, s1201, conducted, 204, s1239, 203, s0004, instant, messaging, 202, s0467, saving, directories, one, byte, xor, encrypted, dat, 201, s0098, 200, s0663, 199, s1064, 198, s1034, 197, s0380, 196, s0273, 195, 194, s0649, filter3, stored, directory, 193, s0533, 192, s0633, 191, s0692, 190, 189, g0091, s0217, 188, 187, s0546, 186, 185, s0148, 184, s0090, 183, 182, 181, 180, 179, s0240, responsible, 178, s0270, 177, s0379, 176, s0592, interest, 175, s0375, automated, 174, 173, s0332, 172, 171, s1240, 170, 169, s0153, 168, s0495, 167, s0662, well, external, storage, device, connected, 166, s0458, 165, s0629, 164, 163, s1148, folder, 162, modeauto, symbolsourcesymbols, s0686, administrator, running, 161, s1209, mouse, logger, will, small, around, click, 160, s0192, configurable, interval, 159, 158, s0147, binary, s0279, 157, s0113, 156, s0184, retrieve, 155, 154, s0223, 153, 152, timedscreenshot, s0194, s0216, 151, 150, s0428, 149, s0013, s0643, shots, s1050, candyking, 148, g0049, 147, 146, 145, s0340, 144, s0644, 143, s1107, 142, 141, s0385, load, call, gdipsaveimagetostream, createcompatibledc, s1090, 140, 139, 138, 137, s0198, 136, g0069, g1019, 134, 133, 132, 131, s1122, bitblt, 130, s0339, 129, 128, s0455, 127, s1059, 126, 125, s0167, initially, 124, s0652, 123, s1156, 122, g0059, s1060, multiple, monitors, s0282, graphic, 120, 119, cgwindowlistcreateimagefromarray, s1016, 118, 117, 116, 115, s0409, 114, s1142, 113, s1213, 112, s0582, 111, 110, 109, s9020, 107, s0681, 106, appdata, s0680, avfoundation, picture, record, period, 105, avcapturescreen, avcapturestillimage, s1185, 104, s0356, 103, s0437, g0094, 101, s0271, grabbing, 100, s0387, s0265, initiate, keylogging, s0088, s0283, simulating, pressing, key, vk_screenshot, accessing, clipboard, converting, s0044, s0163, only, entire, but, separate, case, they, overlapping, s0260, s0398, includes, vnc, stream, feed, s0203, leveraging, encrypts, uploads, stolen, adversary, s9007, viewing, s0431, s1229, s0151, watching, g0043, s0417, monitoring, management, g0115, remotely, s0032, minute, g0047, screencap, s1044, s0277, s0381, certain, control, s0143, displays, top, few, apparent, hide, some, messages, showed, setup, s0182, recordings, g0046, s0152, s0363, locally, s0593, main, s0062, s1159, performed, matched, hash, screenutil, g0035, s0213, s0021, s0187, took, their, g0070, run, s1153, s0235, s0115, periodic, s0050, s0591, s0338, beacon, payload, s0154, s0660, s0667, s0023, timer, either, s1149, s0674, s0631, specific, keywords, title, s0261, s0348, screens_dll, s0484, recording, sends, s0030, s0351, webcam, photos, s0454, s1063, g0060, first, after, initiating, loop, once, thereafter, s0657, s0089, periodically, s0017, uploading, s0234, s0337, s0128, s1081, s0344, s0438, view, s1087, ashenorchestrator, s9031, s0456, ghambar, powerpost, g1044, utility, g0087, g0007, series, s0622, s0331, devices, console, savescreenshot, imagetmp, c0063, procedure, examples, permalink, last, modified, created, collection, tactic, gather, course, included, typically, possible, native, home, join, mclean, hotel, location, details, register, here, search, blog, contribute, benefactors, legal, branding, history, engage, advisory, council, learn, about, started,

Text of the page (random words):
ility to capture screenshots and webcam photos 35 s0351 cannon cannon can take a screenshot of the desktop 36 s0030 carbanak carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the c2 server 37 s0484 carberp carberp can capture display screenshots with the screens_dll dll plugin 38 s0348 cardinal rat cardinal rat can capture screenshots 39 s0261 catchamas catchamas captures screenshots based on specific keywords in the window s title 40 s0631 chaes chaes can capture screenshots of the infected machine 41 s0674 charmpower charmpower has the ability to capture screenshots 42 s1149 chimneysweep chimneysweep can capture screenshots on targeted systems using a timer and either upload them or store them to disk 43 s0023 chopstick chopstick has the capability to capture screenshots 13 s0667 chrommme chrommme has the ability to capture screenshots 44 s0660 clambling clambling has the ability to capture screenshots 45 s0154 cobalt strike cobalt strike s beacon payload is capable of capturing screenshots 46 47 48 s0338 cobian rat cobian rat has a feature to perform screen capture 49 s0591 connectwise connectwise can take screenshots on remote hosts 50 s0050 cosmicduke cosmicduke takes periodic screenshots and exfiltrates them 51 s0115 crimson crimson contains a command to perform screen captures 52 53 54 s0235 crossrat crossrat is capable of taking screen captures 27 s1153 cuckoo stealer cuckoo stealer can run screencapture to collect screenshots from compromised hosts 55 g0070 dark caracal dark caracal took screenshots using their windows malware 27 s0187 daserf daserf can take screenshots 56 32 s0021 derusbi derusbi is capable of performing screen captures 57 s0213 dogcall dogcall is capable of capturing screenshots of the victim s machine 58 59 g0035 dragonfly dragonfly has performed screen captures of victims including by using a tool scr exe which matched the hash of screenutil 60 61 62 s1159 dusttrap dusttrap can capture screenshots 63 s0062 dustysky dustysky captures png screenshots of the main screen 64 s0593 eccentricbandwagon eccentricbandwagon can capture screenshots and store them locally 65 s0363 empire empire is capable of capturing screenshots on windows and macos systems 66 s0152 evilgrab evilgrab has the capability to capture screenshots 67 g0046 fin7 fin7 captured screenshots and desktop video recordings 68 s0182 finfisher finfisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process 69 70 s0143 flame flame can take regular screenshots when certain applications are open that are sent to the command and control server 71 s0381 flawedammyy flawedammyy can capture screenshots 72 s0277 fruitfly fruitfly takes screenshots of the user s desktop 73 s1044 funnydream the funnydream screencap component can take screenshots on a compromised host 74 g0047 gamaredon group gamaredon group s malware can take screenshots of the compromised computer every minute 75 76 77 s0032 gh0st rat gh0st rat can capture the victim s screen remotely 78 g0115 gold southfield gold southfield has used the remote monitoring and management tool connectwise to obtain screen captures from victim s machines 79 s0417 griffon griffon has used a screenshot module that can be used to take a screenshot of the remote system 80 g0043 group5 malware used by group5 is capable of watching the victim s screen 81 s0151 halfbaked halfbaked can obtain screenshots from the victim 82 s1229 havoc havoc can capture screenshots 83 84 85 s0431 hotcroissant hotcroissant has the ability to do real time screen viewing on an infected host 86 s9007 httptroy httptroy has obtained screen captures leveraging the screen command which captures encrypts and uploads the stolen image to the adversary controlled c2 server 87 s0203 hydraq hydraq includes a component based on the code of vnc that can stream a live feed of the desktop of an infected host 88 s0398 hyperbro hyperbro has the ability to take screenshots 89 s0260 invisimole invisimole can capture screenshots of not only the entire screen but of each separate window open in case they are overlapping 90 91 s0163 janicab janicab captured screenshots and sent them out to a c2 server 92 93 s0044 jhuhugit a jhuhugit variant takes screenshots by simulating the user pressing the take screenshot key vk_screenshot accessing the screenshot saved in the clipboard and converting it to a jpg image 94 95 s0283 jrat jrat has the capability to take screenshots of the victim s machine 96 97 s0088 kasidet kasidet has the ability to initiate keylogging and screen captures 98 s0265 kazuar kazuar captures screenshots of the victim s screen 99 s0387 keyboy keyboy has a command to perform screen grabbing 100 s0271 keymarble keymarble can capture screenshots of the victim s machine 101 g0094 kimsuky kimsuky has captured browser screenshots using translatext 102 kimsuky has also obtained screen captures with custom malware 87 s0437 kivars kivars has the ability to capture screenshots on the infected host 103 s0356 konni konni can take screenshots of the victim s machine 104 s1185 lightspy lightspy uses apple s built in avfoundation framework library to access the user s camera and screen it uses the avcapturestillimage to take a picture using the user s camera and the avcapturescreen to take a screenshot or record the user s screen for a specified period of time 105 s0680 litepower litepower can take system screenshots and save them to appdata 106 s0681 lizar lizar can take jpeg screenshots of an infected system 107 108 lizar has also used a plugin to take a screenshot of the infected system 108 s9020 lodeinfo lodeinfo has the ability to take screenshots 109 110 111 s0582 lookback lookback can take desktop screenshots 112 s1213 lumma stealer lumma stealer has taken screenshots of victim machines 113 s1142 lunarmail lunarmail can capture screenshots from compromised hosts 114 s0409 machete machete captures screenshots 115 116 117 118 s1016 macma macma has used apple s core graphic apis such as cgwindowlistcreateimagefromarray to capture the user s screen and open windows 119 120 s0282 macspy macspy can capture screenshots of the desktop over multiple monitors 73 s1060 mafalda mafalda can take a screenshot of the target machine and save it to a file 121 g0059 magic hound magic hound malware can take a screenshot and upload the file to its c2 server 122 s1156 manjusaka manjusaka can take screenshots of the victim desktop 123 s0652 markirat markirat can capture screenshots that are initially saved as scr jpg 124 s0167 matryoshka matryoshka is capable of performing screen captures 125 126 s1059 metamain metamain can take and save screenshots 121 127 s0455 metamorfo metamorfo can collect screenshots of the victim s machine 128 129 s0339 micropsia micropsia takes screenshots every 90 seconds by calling the gdi32 bitblt api 130 s1122 mispadu mispadu has the ability to capture screenshots on compromised hosts 131 132 133 134 g1019 moustachedbouncer moustachedbouncer has used plugins to take screenshots on targeted systems 135 g0069 muddywater muddywater has used malware that can capture screenshots of the victim s machine 136 s0198 netwire netwire can capture the victim s screen 137 138 139 140 s1090 nightclub nightclub can load a module to call createcompatibledc and gdipsaveimagetostream for screen capture 135 s0385 njrat njrat can capture screenshots of the victim s machines 141 142 s1107 nkabuse nkabuse can take screenshots of the victim machine 143 s0644 obliquerat obliquerat can capture a screenshot of the current screen 144 s0340 octopus octopus can capture screenshots of the victims machine 145 146 147 g0049 oilrig oilrig has a tool called candyking to capture a screenshot of user s desktop 148 s1050 pcshare pcshare can take screen shots of a compromised machine 74 s0643 peppy peppy can take screenshots on targeted systems 52 s0013 plugx plugx allows the operator to capture screenshots 149 s0428 poetrat poetrat has the ability to take screen captures 150 151 s0216 pooraim pooraim can perform screen capturing 58 s0194 powersploit powersploit s get timedscreenshot exfiltration module can take screenshots at regular intervals 152 153 s0223 powerstats powerstats can retrieve screenshots from compromised hosts 154 155 s0184 powruner powruner can capture a screenshot from a victim 156 s0113 prikormka prikormka contains a module that captures screenshots of the victim s desktop 157 s0279 proton proton captures the content of the desktop with the screencapture binary 73 s0147 pteranodon pteranodon can capture screenshots at a configurable interval 158 159 s0192 pupy pupy can drop a mouse logger that will take small screenshots around at each click and then send back to the server 160 s1209 quick assist quick assist allows for the remote administrator to take screenshots of the running system 161 s0686 quietsieve quietsieve has taken screenshots every five minutes and saved them to the user s local application data folder under temp symbolsourcesymbols icons or temp modeauto icons 162 s1148 raccoon stealer raccoon stealer can capture screenshots from victim systems 163 164 s0629 rainyday rainyday has the ability to capture screenshots 165 s0458 ramsay ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected 166 s0662 rcsession rcsession can capture screenshots from a compromised host 167 s0495 rdat rdat can take a screenshot on the infected system 168 s0153 redleaves redleaves can capture screenshots 169 170 s1240 redline stealer redline stealer can capture screenshots on a compromised host 171 172 s0332 remcos remcos takes automated screenshots of the infected machine 173 174 s0375 remexi remexi takes screenshots of windows of interest 175 s0592 remoteutilities remoteutilities can take screenshots on a compromised host 176 s0379 revenge rat revenge rat has a plugin for screen capture 177 s0270 roguerobin roguerobin has a command named screenshot that may be responsible for taking screenshots of the victim machine 178 s0240 rokrat rokrat can capture screenshots of the infected system using the gdi32 library 179 180 181 182 183 s0090 rover rover takes screenshots of the compromised system s desktop and saves them to c system screenshot bmp for exfiltration every 60 minutes 184 s0148 rtm rtm can capture screenshots 185 186 s0546 sharpstage sharpstage has the ability to capture the victim s screen 187 188 s0217 shutterspeed shutterspeed can capture screenshots 58 g0091 silence silence can capture victim screen activity 189 190 s0692 silenttrinity silenttrinity can take a screenshot of the current desktop 191 s0633 sliver sliver can take screenshots of the victim s active display 192 s0533 slothfulmedia slothfulmedia has taken a screenshot of a victim s desktop named it filter3 jpg and stored it in the local directory 193 s0649 smokedham smokedham can capture screenshots of the victim s desktop 194 195 s0273 socksbot socksbot can take screenshots 196 s0380 stonedrill stonedrill can take screenshots 197 s1034 strifewater strifewater has the ability to take screen captures 198 s1064 svcready svcready can take a screenshot from an infected host 199 s0663 sysupdate sysupdate has the ability to capture screenshots 200 s0098 t9000 t9000 can take screenshots of the desktop and target application windows saving them to user directories as one byte xor encrypted dat files 201 s0467 tajmahal tajmahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications 202 s0004 tinyzbot tinyzbot contains screen capture functionality 203 s1239 toneshell toneshell has conducted screen capturing 204 s1201 translatext translatext has the ability to capture screenshots of new browser tabs based on the presence of the capture flag 102 s0094 trojan karagany trojan karagany can take a desktop screenshot and save the file into programdata mail mailag shot png 205 206 s1196 troll stealer troll stealer can capture screenshots from victim machines 207 208 s0647 turian turian has the ability to take screenshots 209 s0199 turnedup turnedup is capable of taking screenshots 210 s0275 uppercut uppercut can capture desktop screenshots in the png format and send them to the c2 server 211 212 213 214 s0386 ursnif ursnif has used hooked apis to take screenshots 215 216 s0476 valak valak has the ability to take screenshots on a compromised host 217 s0257 vermin vermin can perform screen captures of the victim s machine 218 g1055 void manticore void manticore has captured screen content during an active zoom session 219 g1017 volt typhoon volt typhoon has obtained a screenshot of the victim s system using the gdi32 dll and gdiplus dll libraries 220 g1035 winter vivern winter vivern delivered powershell scripts capable of taking screenshots of victim machines 221 s1065 woody rat woody rat has the ability to take a screenshot of the infected host desktop using windows gdi 222 s0161 xagentosx xagentosx contains the takescreenshot along with starttakescreenshot and stoptakescreenshot functions to take screenshots using the cggetactivedisplaylist cgdisplaycreateimage and nsimage initwithcgimage methods 12 s0658 xcsset xcsset saves a screen capture of the victim s system with a numbered filename and jpg extension screen captures are taken at specified intervals based on the system 223 s1207 xloader xloader can capture screenshots on compromised hosts 224 225 s0248 yty yty collects screenshots of the victim machine 226 s0251 zebrocy a variant of zebrocy captures screenshots of the victim s machine in jpeg and bmp format 36 227 228 229 230 231 s0330 zeus panda zeus panda can take screenshots of the victim s machine 232 s0086 zlib zlib has the ability to obtain screenshots of the compromised system 233 s0412 zxshell zxshell can capture screenshots 234 mitigations this type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features detection strategy id name analytic id analytic description det0346 detect screen capture via commands and api calls an0980 unusual use of screen capture apis e g copyfromscreen or command line tools to write image files to disk an0981 invocation of built in commands like screencapture or use of undocumented apis from suspicious parent processes an0982 use of tools like xwd or import to generate screenshots especially under non gui parent processes references microsoft n d graphics copyfromscreen method retrieved march 24 2020 thomas reed 2017 january 18 new mac backdoor using antiquated code retrieved july 5 2017 cert polska 2026 january 30 energy sector incident report 29 december retrieved april 22 2026 brumaghin e et al 2018 october 15 old dog new tricks analysing new rtf based campaign distributing agent tesla lok...