Tradecraft Labs

End-to-end technique walkthroughs and operator workflows, with detection and validation.

Tradecraft Labs Archive

7 entries

Field Analysis

Dual UseTradecraft LabsJun 7, 202611 min read

The Step After the Click: Five Persistence Primitives That Survive Your Response

Mailbox rules, OAuth grants, replayed sessions, RMM agents, and downstream account changes are not the aftermath of an intrusion — they are the point. A field guide to the persistence layer most response playbooks still treat as cleanup.

The Procedure Is the Threat: Why an Intrusion's Shape Outlives Its Toolkit

Runtimes, platforms, and brands rotate every quarter. The six handoffs that move a victim from manufactured urgency to durable persistence have barely changed in five years, and they are what defenders can actually build for.

By PhishPond Desk

Field Analysis

Dual UseTradecraft LabsJun 7, 20267 min read

Silent Ransom Group Walks Into the Office: Help-Desk Impersonation Adds a Physical Step

An FBI flash alert says Silent Ransom Group escalates its IT-impersonation chain by sending an operator to the target's office when the phone-and-email stages fail. Law firms are the named victim set, and the number of leaked firms is rising.

MuddyWater's Teams Playbook: Screen-Share Credential Theft Behind a False Flag

An Iranian actor opened an intrusion with a Microsoft Teams chat request and a screen-sharing session, harvested credentials live, then staged ransomware as cover for a state-backed operation.

APT Methods Watch: Geofenced Lures, ClickFix, and Supply Chain Trust

Recent actor reporting points to a practical trend line: adversaries are combining selective delivery, user-driven execution, and trusted developer channels.

RMM Phishing Turns the Click Into Remote Access

Recent campaigns using SimpleHelp and ScreenConnect show how phishing can skip credential theft and move straight to persistent endpoint control.

Device Code Phishing: A Walkthrough and Detection Playbook

Device code phishing turns a legitimate OAuth flow into a credential-free token theft technique. Here is how it runs end-to-end and what defenders can hunt on in Sentinel and Defender XDR.

Tradecraft Labs

Tradecraft Labs Archive

The Step After the Click: Five Persistence Primitives That Survive Your Response

The Procedure Is the Threat: Why an Intrusion's Shape Outlives Its Toolkit

Silent Ransom Group Walks Into the Office: Help-Desk Impersonation Adds a Physical Step

MuddyWater's Teams Playbook: Screen-Share Credential Theft Behind a False Flag

APT Methods Watch: Geofenced Lures, ClickFix, and Supply Chain Trust

RMM Phishing Turns the Click Into Remote Access

Device Code Phishing: A Walkthrough and Detection Playbook

Explore Other Categories

Tradecraft Labs

Tradecraft Labs Archive

The Step After the Click: Five Persistence Primitives That Survive Your Response

The Procedure Is the Threat: Why an Intrusion's Shape Outlives Its Toolkit

Silent Ransom Group Walks Into the Office: Help-Desk Impersonation Adds a Physical Step

MuddyWater's Teams Playbook: Screen-Share Credential Theft Behind a False Flag

APT Methods Watch: Geofenced Lures, ClickFix, and Supply Chain Trust

RMM Phishing Turns the Click Into Remote Access

Device Code Phishing: A Walkthrough and Detection Playbook

Explore Other Categories