Procedure examples

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.

Ninja has gained execution through victims opening malicious executable files embedded in zip archives.

Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.

KOPILUWAK has gained execution through malicious attachments.

ThreatNeedle relies on a victim to click on a malicious document for initial execution.

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

During Operation AkaiRyū, MirrorFace used malicious files to drop ROAMINGHOUSE.

AppleSeed can achieve execution through users running malicious file attachments distributed via email.

NETWIRE has been executed through luring victims into opening malicious documents.

Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.

EnvyScout has been executed through malicious files attached to e-mails.

STATICPLUGIN has required user execution to load subsequent malicious payloads.

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Woody RAT has relied on users opening a malicious email attachment for execution.

Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.

Snip3 can gain execution through the download of visual basic files.

Rifdoor has been executed from malicious Excel or Word documents containing macros.

The GuLoader executable has been retrieved via embedded macros in malicious Word documents.

InvisiMole can deliver trojanized versions of software and documents, relying on user execution.

CLAIMLOADER has used tailored decoy documents as part of the installation routine to entice users to open attachments.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

RustyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.

DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.

BeaverTail has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference. BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.

ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.

Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.

PlugX has leveraged an initial executable disguised as a legitimate document to trick the target into opening it.

Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.

Lumma Stealer has gained initial execution through victims opening malicious executable files embedded in zip archives, and MSI files within RAR files.

Clambling has gained execution through luring victims into opening malicious files.

DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

Mongall has relied on a user opening a malicious document for execution.

SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.

Latrodectus has lured users into opening malicious email attachments for execution.

Saint Bot has relied on users to execute a malicious attachment delivered via spearphishing.

Chaes requires the user to click on the malicious Word document to execute the next part of the attack.

LODEINFO has been executed via victims opening malicious email attachments.

A Word document delivering TYPEFRAME prompts the user to enable macro execution.

Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.

Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Bandook has used lure documents to convince the user to enable macros.

KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.

DnsSystem has lured victims into opening macro-enabled Word documents for execution.

KGH_SPY has been spread through Word documents containing malicious macros.

Kerrdown has gained execution through victims opening malicious files.