FIN7G0046 ↗
Has used malicious USBs to emulate keystrokes to launch PowerShell to download and execute malware from the adversary's server.12
tfMITRE ATT&CK technique
Input Injection T1674
- Tactic
- Execution
- Platforms
- Windows, macOS, Linux
- Version
- 1.0
- Created
- 27 March 2025
- Last modified
- 15 April 2025
- Contributor
- Alexey Kleymenov
Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.