The ATT&CK knowledge base, developed by MITRE,
categorizes adversary tactics and techniques into multiple
categories to describe the adversary's behavior.
The tactics are categories that cover different phases of an
attack and allow defensive teams to model an adversary's actions
and improve the defense of their networks.
We will cover three tactics that Pupy can be used for,
credential dumping, input capture, and encrypted channel.
If an attacker wanted to use Pupy as a command‑and‑control server
against their victims on Globomantics' network,
depicted here,
they would first have to stand up a Pupy server and
have it generate client files, which they would run on their exploited hosts.
These hosts would then connect back to the Pupy server over the
attacker's chosen protocol and establish an encrypted session,
which will make it appear as legitimate traffic on the network.
This enables the attackers to then securely transfer
information from the victims back to the Pupy server,
or escalate privileges and obtain access to additional resources.