Lateral-Movement
Credential Dumping — Post-Exploitation Identity Compromise Technique
Credential dumping is a post-exploitation technique used to extract authentication material from compromised systems. This SECMONS record explains how credential dumping works, its role in enterprise intrusions, and defensive detection strategies.
Lateral Movement — Expanding Access Across Internal Systems
Lateral Movement is a post-compromise attack technique where an adversary moves from one compromised system to others within the same network. This SECMONS glossary entry explains how lateral movement works, why it is operationally critical, and how defenders should detect and contain it.
Supply Chain Attack — Compromising Trusted Vendors to Reach Downstream Targets
A supply chain attack occurs when threat actors compromise a trusted vendor, software provider, or service to gain indirect access to downstream customers. This SECMONS glossary entry explains how supply chain attacks work, common techniques, and how defenders should reduce third-party risk.
LockBit — Ransomware-as-a-Service Ecosystem & Operational Profile
LockBit is a ransomware-as-a-service (RaaS) ecosystem responsible for widespread double-extortion campaigns targeting enterprise, government, and critical infrastructure organizations. This profile provides structured analysis of LockBit’s operational model, techniques, and defensive implications.
APT29 (Cozy Bear / NOBELIUM) — Espionage-Focused Threat Actor Profile
APT29 (also tracked as Cozy Bear and NOBELIUM) is a widely reported espionage-focused threat actor associated with long-term, stealthy intrusion campaigns. This SECMONS profile summarizes publicly documented targeting patterns, techniques, and defensive implications.
FIN7 — Financially Motivated Intrusion Group Profile
FIN7 is a financially motivated intrusion group publicly linked to large-scale payment card theft, enterprise compromise campaigns, and later ransomware operations. This SECMONS profile summarizes verified targeting patterns, techniques, and defensive implications.
Ryuk — Targeted Ransomware Associated with Enterprise Intrusions
Ryuk is a targeted ransomware strain publicly associated with high-impact enterprise intrusions, often deployed following credential theft and lateral movement. This SECMONS profile provides structured analysis of Ryuk’s operational patterns, ecosystem relationships, and defensive implications.
TrickBot — Modular Banking Trojan and Malware Delivery Framework
TrickBot is a modular malware platform initially developed as a banking trojan and later expanded into a flexible intrusion framework used for credential theft, lateral movement, and ransomware staging. This SECMONS profile provides structured technical and operational analysis.