Procedure examples

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.

Snip3 has been executed through luring victims into clicking malicious links.

GuLoader has relied upon users clicking on links to malicious documents.

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.

SpicyOmelette has been executed through malicious links within spearphishing emails.

Javali has achieved execution through victims clicking links to malicious websites.

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.

Latrodectus has been executed through malicious links distributed in email campaigns.

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.

Kerrdown has gained execution through victims opening malicious links.

Grandoreiro has used malicious links to gain execution on victim machines.

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.

PLEAD has been executed via malicious links in e-mails.

OutSteel has relied on a user to click a malicious link within a spearphishing email.

BackConfig has compromised victims via links to URLs hosting malicious content.

Melcoz has gained execution through victims opening malicious links.

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

Qilin has been executed by luring victims into clicking links in spearphishing emails.

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.

QakBot has gained execution through users opening malicious links.

Hancitor has relied upon users clicking on a malicious link delivered through phishing.

Kali365 has directed victims to actor-controlled phishing pages through malicious links, initiating device code authorization flows or adversary-in-the-middle session capture.

During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.

During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.

Mustang Panda distributed malicious LNK objects for user execution during RedDelta Modified PlugX Infection Chain Operations.

During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.

During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.

During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.

During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them.

During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.

Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL.

During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.

During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments.

During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

Indrik Spider has attempted to get users to click on a malicious zipped file.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

Naikon has convinced victims to open malicious attachments to execute malware.