Procedure examples

Javali has achieved execution through victims clicking links to malicious websites.

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.

Latrodectus has been executed through malicious links distributed in email campaigns.

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.

Kerrdown has gained execution through victims opening malicious links.

Grandoreiro has used malicious links to gain execution on victim machines.

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.

PLEAD has been executed via malicious links in e-mails.

OutSteel has relied on a user to click a malicious link within a spearphishing email.

BackConfig has compromised victims via links to URLs hosting malicious content.

Melcoz has gained execution through victims opening malicious links.

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

Qilin has been executed by luring victims into clicking links in spearphishing emails.

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.

QakBot has gained execution through users opening malicious links.

Hancitor has relied upon users clicking on a malicious link delivered through phishing.

Kali365 has directed victims to actor-controlled phishing pages through malicious links, initiating device code authorization flows or adversary-in-the-middle session capture.

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.

Ninja has gained execution through victims opening malicious executable files embedded in zip archives.

Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.

KOPILUWAK has gained execution through malicious attachments.

ThreatNeedle relies on a victim to click on a malicious document for initial execution.

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

During Operation AkaiRyū, MirrorFace used malicious files to drop ROAMINGHOUSE.

AppleSeed can achieve execution through users running malicious file attachments distributed via email.

NETWIRE has been executed through luring victims into opening malicious documents.

Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.

EnvyScout has been executed through malicious files attached to e-mails.

STATICPLUGIN has required user execution to load subsequent malicious payloads.

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Woody RAT has relied on users opening a malicious email attachment for execution.

Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.

Snip3 can gain execution through the download of visual basic files.

Rifdoor has been executed from malicious Excel or Word documents containing macros.

The GuLoader executable has been retrieved via embedded macros in malicious Word documents.

InvisiMole can deliver trojanized versions of software and documents, relying on user execution.

CLAIMLOADER has used tailored decoy documents as part of the installation routine to entice users to open attachments.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

RustyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.

DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.

BeaverTail has been executed through lures involving malicious JavaScript projects or trojanized remote conferencing software such as MicroTalk or FreeConference. BeaverTail has also been executed through macOS and Windows installers disguised as chat applications.

ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.

Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.

PlugX has leveraged an initial executable disguised as a legitimate document to trick the target into opening it.