Screen Capture (T1113): Real Cases
MITRE Definition ↗Key Facts
- ATT&CK Technique Identifier: T1113.
- Tactical Phase: Collection.
- Substantiated in 2 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (2)
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
"Defendants configured video screen-recording modules to capture point-of-sale terminal transactions in real time."
Okta Customer Support Console Intrusion (LAPSUS$)
Teenage cyber extortion collective LAPSUS$ compromised a third-party customer support contractor (Sitel) workstation via an active RDP session, gaining access to Okta SuperUser administrative diagnostic tools affecting 366 enterprise tenants.
"Adversaries captured screenshots of internal SuperUser support consoles and customer Slack channels, publishing them to Telegram channels to substantiate extortion demands."
Commonly Charged Criminal Statutes
Unauthorized Access to Obtain Protected Information
Prohibits intentionally accessing a computer without authorization or exceeding authorized access to obtain financial, government, or protected computer records.
Conspiracy to Commit Computer Fraud
Punishes any person who conspires to commit or attempts to commit any computer fraud offense under section 1030.
RICO Conspiracy (Racketeering)
Prohibits conspiring to conduct or participate in the conduct of an enterprise's affairs through a pattern of racketeering activity.