Procedure examples

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

Indrik Spider has attempted to get users to click on a malicious zipped file.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

Naikon has convinced victims to open malicious attachments to execute malware.

FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.

Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.

Andariel has attempted to lure victims into enabling malicious macros within email attachments.

CURIUM has lured users into opening malicious files delivered via social media.

Sidewinder has lured targets to click on malicious files to gain execution in the target environment.

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

Contagious Interview has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.

TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.

APT37 has sent spearphishing attachments attempting to get a user to open them.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.

TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.

Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.

Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.

Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.

DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.

Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.

BlackTech has used e-mails with malicious documents to lure victims into installing malware.

Leviathan has sent spearphishing attachments attempting to get a user to click.

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.

RedCurl has used malicious files to infect the victim machines.

Mofang's malicious spearphishing attachments required a user to open the file after receiving.

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.

TA551 has prompted users to enable macros within spearphishing attachments to install malware.