Procedure examples

RedLine Stealer malware has been executed through the download of malicious files. RedLine Stealer has also lured users to install malware with an Install Wizard interface.

Black Basta has been downloaded and executed from malicious Excel files.

SQLRat relies on users clicking on an embedded image to execute the scripts.

RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

StrelaStealer relies on user execution of a malicious file for installation.

Grandoreiro has infected victims via malicious attachments.

ZxxZ has relied on victims to open a malicious attachment delivered via email.

Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.

LunarMail has been installed through a malicious macro in a Microsoft Word document.

JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.

REvil has been executed via malicious MS Word e-mail attachments.

Valak has been executed via Microsoft Word documents containing malicious macros.

Taidoor has relied upon a victim to click on a malicious email attachment.

NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.

PLEAD has been executed via malicious e-mail attachments.

Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.

DanBot has relied on victims' opening a malicious file for initial execution.

Ramsay has been executed through malicious e-mail attachments.

AshTag has been executed through victims downloading and opening malicious RAR archive files.

OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.

BoomBox has gained execution through user interaction with a malicious file.

LAMEHUG has been executed through victim interaction with malicious email attachments made to look like legitimate AI applications or documents.

Mango has been executed through a Microsoft Word document with a malicious macro.

Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.

PoetRAT has used spearphishing attachments to infect victims.

HIUPAN has lured victims into executing malicious files from USBs including the use of files such as USBconfig.exe.

KOCTOPUS has relied on victims clicking a malicious document for execution.

Heyoka Backdoor has been spread through malicious document lures.

Disco has been executed through inducing user interaction with malicious .zip and .msi files.

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Qilin has been delivered to victims through spearphishing emails with malicious attachments.

AppleJeus has required user execution of a malicious MSI installer.

STARWHALE has relied on victims opening a malicious Excel file for execution.

Agent Tesla has been executed through malicious e-mail attachments

Astaroth has used malicious files including VBS, LNK, and HTML for execution.

QakBot has gained execution through users opening malicious attachments.

SYSCON has been executed by luring victims to open malicious e-mail attachments.

Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.

Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.

OSX/Shlayer has relied on users mounting and executing a malicious DMG file.

JSS Loader has been executed through malicious attachments contained in spearphishing emails.

WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.

CSPY Downloader has been delivered via malicious documents with embedded macros.

CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.

AsyncRAT has been executed through victims opening malicious file attachments.

Brute Ratel C4 has gained execution through users opening malicious documents.

Remcos has been executed by luring victims into opening malicious email attachments including Excel files.

BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.