Several tools used bySuckfly have been command-line driven.^[2]

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.^[2]

Suckfly used a signed credential-dumping tool to obtain victim account credentials.^[2]

Suckfly has used stolen certificates to sign its malware.^[1]

Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.^[2]