Procedure examples

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.

APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.

APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).

Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.

Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).

VersaMem was installed through exploitation of CVE-2024-39717 in Versa Director servers.

HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.

Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.

Woody RAT has relied on CVE-2022-30190 (Follina) for execution during delivery.

InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.

DealersChoice leverages vulnerable versions of Flash to perform execution.

XLoader has exploited Office vulnerabilities during local execution such as CVE-2017-11882 and CVE-2018-0798.

SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.

Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.

EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.

SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).

Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.

ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.

Water Curupira Pikabot Distribution requires users to interact with malicious attachments in order to start Pikabot installation.

Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.

LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.

Raspberry Robin execution can rely on users directly interacting with malicious LNK files.

Lumma Stealer has been distributed through a fake CAPTCHA that presents instructions to the victim to open Windows Run window (“Windows Button + R”) and paste clipboard contents (“CTRL + V”) and press “Enter” to execute a Base64-encoded PowerShell.

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.

Mustang Panda distributed hyperlinks that would result in an MSC file running a PowerShell command to download and install a remotely-hosted MSI file during RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.

During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.

Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.

During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.

During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.

During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.

APT38 has used links to execute a malicious Visual Basic script.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.

APT3 has lured victims into clicking malicious links delivered through spearphishing.

Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.

Kimsuky has lured victims into clicking malicious links.