Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., Chat Messages) * Source code snippets * Links to network shares and other internal resources * Proprietary data1 * Discussions about ongoing incident response efforts23 In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.45
- Guardian Grand Theft Auto Leak 2022
- SC Magazine Ragnar Locker 2021
- Microsoft DEV-0537
- Sentinel Labs NullBulge 2024
- Permiso Scattered Spider 2023
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0117 | Fox Kitten | — |
| grp_g1015 | Scattered Spider | — |
| grp_g1004 | LAPSUS$ | — |
| grp_g0082 | APT38 | DPRK |
| grp_g1059 | NIMBUS MANTICORE | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.