Procedure examples

APT38 has conducted spearphishing campaigns using malicious email attachments.

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.

SideCopy has sent spearphishing emails with malicious hta file attachments.

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns. Kimsuky has also distributed emails with attached compressed zip files that contained malicious .LNK files masquerading as legitimate files. Kimsuky has delivered tailored PDF documents that contain malicious links.

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.

admin@338 has sent emails with malicious Microsoft Office documents attached.

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

Dragonfly has sent emails with malicious attachments to gain initial access.

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

Naikon has used malicious e-mail attachments to deliver malware.

FIN6 has targeted victims with e-mails containing malicious attachments.

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.

Gallmaker sent emails with malicious Microsoft Office documents attached.

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.

CURIUM has used phishing with malicious attachments for initial access to victim environments.

Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.

Mustang Panda has used spearphishing attachments to deliver initial access payloads. Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.

TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.

APT37 delivers malware using spearphishing emails with malicious HWP attachments.

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

Higaisa has sent spearphishing emails containing malicious attachments.

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.

TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.

Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.

APT1 has sent spearphishing emails containing malicious attachments.

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.

Confucius has crafted and sent victims malicious attachments to gain initial access.

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.

Winter Vivern leverages malicious attachments delivered via email for initial access activity.

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.

RedCurl has used phishing emails with malicious files to gain initial access.

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.

TA551 has sent spearphishing attachments with password protected ZIP files.

Star Blizzard has sent emails with malicious .pdf files to spread malware.

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.