H3XA — Operational Evidence

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen , xwd , or screencapture .(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)

172 recorded

Relationships

mapped-to

from Collect Data from Screen Capture

Technique

uses

from 2025 Poland Wiper Attacks

Campaign

uses

from Agent Tesla

Malware

uses

from AppleSeed

Malware

uses

from APT28

Group

uses

from APT39

Group

uses

from APT42

Group

uses

from Aria-body

Malware

uses

from AshTag

Malware

uses

from AsyncRAT

Tool

uses

from Attor

Malware

uses

from Azorult

Malware

uses

from BADHATCH

Malware

uses

from BADNEWS

Malware

uses

from BadPatch

Malware

uses

from Bandook

Malware

uses

from BISCUIT

Malware

uses

from BlackEnergy

Malware

uses

from BLUELIGHT

Malware

uses

from BRONZE BUTLER

Group

uses

from Brute Ratel C4

Tool

uses

from Cadelspy

Malware

uses

from Cannon

Malware

uses

from Carbanak

Malware

uses

from Carberp

Malware

uses

from Cardinal RAT

Malware

uses

from Catchamas

Malware

uses

from Chaes

Malware

uses

from CharmPower

Malware

uses

from CHIMNEYSWEEP

Malware

uses

from CHOPSTICK

Malware

uses

from Chrommme

Malware

uses

from Clambling

Malware

uses

from Cobalt Strike

Malware

uses

from Cobian RAT

Malware

uses

from ConnectWise

Tool

uses

from CosmicDuke

Malware

uses

from Crimson

Malware

uses

from CrossRAT

Malware

uses

from Cuckoo Stealer

Malware

uses

from Dark Caracal

Group

uses

from Daserf

Malware

uses

from Derusbi

Malware

uses

from DOGCALL

Malware

uses

from Dragonfly

Group

uses

from DUSTTRAP

Malware

uses

from DustySky

Malware

uses

from ECCENTRICBANDWAGON

Malware

uses

from Empire

Tool

uses

from EvilGrab

Malware

uses

from FIN7

Group

uses

from FinFisher

Malware

uses

from Flame

Malware

uses

from FlawedAmmyy

Malware

uses

from FruitFly

Malware

uses

from FunnyDream

Malware

uses

from Gamaredon Group

Group

uses

from gh0st RAT

Malware

uses

from GOLD SOUTHFIELD

Group

uses

from GRIFFON

Malware

uses

from Group5

Group

uses

from HALFBAKED

Malware

uses

from Havoc

Malware

uses

from HotCroissant

Malware

uses

from HTTPTroy

Malware

uses

from Hydraq

Malware

uses

from HyperBro

Malware

uses

from InvisiMole

Malware

uses

from Janicab

Malware

uses

from JHUHUGIT

Malware

uses

from jRAT

Malware

uses

from Kasidet

Malware

uses

from Kazuar

Malware

uses

from KeyBoy

Malware

uses

from KEYMARBLE

Malware

uses

from Kimsuky

Group

uses

from Kivars

Malware

uses

from KONNI

Malware

uses

from LightSpy

Malware

uses

from LitePower

Malware

uses

from Lizar

Malware

uses

from LODEINFO

Malware

uses

from LookBack

Malware

uses

from Lumma Stealer

Malware

uses

from LunarMail

Malware

uses

from Machete

Malware

uses

from MacMa

Malware

uses

from MacSpy

Malware

uses

from Mafalda

Malware

uses

from Magic Hound

Group

uses

from Manjusaka

Malware

uses

from MarkiRAT

Malware

uses

from Matryoshka

Malware

uses

from metaMain

Malware

uses

from Metamorfo

Malware

uses

from Micropsia

Malware

uses

from Mispadu

Malware

uses

from MoustachedBouncer

Group

uses

from MuddyWater

Group

uses

from NETWIRE

Malware

uses

from NightClub

Malware

uses

from njRAT

Malware

uses

from NKAbuse

Malware

uses

from ObliqueRAT

Malware

uses

from Octopus

Malware

uses

from OilRig

Group

uses

from PcShare

Tool

uses

from Peppy

Malware

uses

from PlugX

Malware

uses

from PoetRAT

Malware

uses

from POORAIM

Malware

uses

from PowerSploit

Tool

uses

from POWERSTATS

Malware

uses

from POWRUNER

Malware

uses

from Prikormka

Malware

uses

from Proton

Malware

uses

from Pteranodon

Malware

uses

from Pupy

Tool

uses

from Quick Assist

Tool

uses

from QuietSieve

Malware

uses

from Raccoon Stealer

Malware

uses

from RainyDay

Malware

uses

from Ramsay

Malware

uses

from RCSession

Malware

uses

from RDAT

Malware

uses

from RedLeaves

Malware

uses

from RedLine Stealer

Malware

uses

from Remcos

Tool

uses

from Remexi

Malware

uses

from RemoteUtilities

Tool

uses

from Revenge RAT

Malware

uses

from RogueRobin

Malware

uses

from ROKRAT

Malware

uses

from Rover

Malware

uses

from RTM

Malware

uses

from SharpStage

Malware

uses

from SHUTTERSPEED

Malware

uses

from Silence

Group

uses

from SILENTTRINITY

Tool

uses

from Sliver

Tool

uses

from SLOTHFULMEDIA

Malware

uses

from SMOKEDHAM

Malware

uses

from Socksbot

Malware

uses

from StoneDrill

Malware

uses

from StrifeWater

Malware

uses

from SVCReady

Malware

uses

from SysUpdate

Malware

uses

from T9000

Malware

uses

from TajMahal

Malware

uses

from TinyZBot

Malware

uses

from TONESHELL

Malware

uses

from TRANSLATEXT

Malware

uses

from Trojan.Karagany

Malware

uses

from Troll Stealer

Malware

uses

from Turian

Malware

uses

from TURNEDUP

Malware

uses

from UPPERCUT

Malware

uses

from Ursnif

Malware

uses

from Valak

Malware

uses

from VERMIN

Malware

uses

from VOID MANTICORE

Group

uses

from Volt Typhoon

Group

uses

from Winter Vivern

Group

uses

from Woody RAT

Malware

uses

from XAgentOSX

Malware

uses

from XCSSET

Malware

uses

from XLoader

Malware

uses

from yty

Malware

uses

from Zebrocy

Malware

uses

from Zeus Panda

Malware

uses

from ZLib

Malware

uses

from ZxShell

Malware

3 external

References

mitre-attack

T1113

open

CopyFromScreen .NET

https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8

open

Antiquated Mac Malware

https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/

open