1) Web Shells 2) A modified version of the China Chopper web shell was used for initial compromise. 3) Custom-built web shells were used for later phases of the attack. 7) WMI and PowerShell commands were used for various tasks. 8) RAT 9) PoisonIvy was used to maintain access across the compromised assets. 10) PlugX was used in some of the instances that we're aware of. 11) Credential Dumpers 12) A modified version of Mimikatz was used to dump credentials stored on the compromised machines. 13) A PowerShell-based Mimikatz was also used to dump credentials stored on the compromised machines. 14) Lateral movement 15) WMI was used for lateral movement. 16) PsExec was also used for lateral movement. 19) Compression tool 20) Winrar was used to compress and password-protect stolen data