GRIM SPIDER also has been observed selecting a server to be the primary staging point. Subsequently, the adversary copies the Microsoft SysInternals PSTools archive to this system, and executes PsExec.exe, a utility that allows them to move laterally and execute commands on other Windows systems within the infrastructure. Using this common administrator tool, GRIM SPIDER can traverse the network, remotely installing TrickBot and adding persistence to new targets. TrickBot also has the shareDll module for propagating to other hosts using the current, active user credentials