Typical file exfiltration modules deployed by threat actors usually consist of the ability to enumerate and exfiltrate files. These implants enumerate files in specific drives or directories and exfiltrate the file lists first. Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. It downloads a file listing from a remote location that contains the file paths of specific files of interest to the attackers. The file listing is so precise that the attackers know the exact file paths of the files they're looking for on an infected endpoint. This prevents re-infection of the target.A marker file is created in an attacker-specified folder and is checked before the exfiltration module begins its malicious activities. If the marker file is not found, the module will proceed with its recon and exfiltration activities.In August 2021, we saw a minor variation of the same script being deployed in the wild. Instead, it's hardcoded into the scripts showing that the attackers already know the identities of the targets that they are trying to infect. This indicates that this is a highly targeted attack.In October 2021, we observed another update in the file exfiltration scripts