Procedure examples

Star Blizzard has lured targets into opening malicious .pdf files to deliver malware.

Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.

LazyScripter has lured users to open malicious email attachments.

Windshift has used e-mail attachments to lure victims into executing malicious code.

Whitefly has used malicious .exe or .dll files disguised as documents or images.

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

Malteiro has relied on users to execute .zip file attachments containing malicious URLs.

RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.

APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

Tonto Team has relied on user interaction to open their malicious RTF documents.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Earth Lusca required users to click on a malicious file for the loader to activate.

FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.

Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.

Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.

Magic Hound has attempted to lure victims into opening malicious email attachments.

Ajax Security Team has lured victims into executing malicious files.

Threat Group-3390 has lured victims into opening malicious files containing malware.

APT33 has used malicious e-mail attachments to lure victims into executing malware.

FIN8 has used malicious e-mail attachments to lure victims into executing malware.

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.