Procedure examples

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.

Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.

Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.

HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.

Magic Hound has attempted to lure victims into opening malicious email attachments.

Ajax Security Team has lured victims into executing malicious files.

Threat Group-3390 has lured victims into opening malicious files containing malware.

APT33 has used malicious e-mail attachments to lure victims into executing malware.

FIN8 has used malicious e-mail attachments to lure victims into executing malware.

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.

TrickBot has attempted to get users to launch malicious documents to deliver its payload.

BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.

Ninja has gained execution through victims opening malicious executable files embedded in zip archives.

Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.

KOPILUWAK has gained execution through malicious attachments.

ThreatNeedle relies on a victim to click on a malicious document for initial execution.

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.

StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

During Operation AkaiRyū, MirrorFace used malicious files to drop ROAMINGHOUSE.

AppleSeed can achieve execution through users running malicious file attachments distributed via email.

NETWIRE has been executed through luring victims into opening malicious documents.

Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.

EnvyScout has been executed through malicious files attached to e-mails.

STATICPLUGIN has required user execution to load subsequent malicious payloads.

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Woody RAT has relied on users opening a malicious email attachment for execution.

Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.

Snip3 can gain execution through the download of visual basic files.

Rifdoor has been executed from malicious Excel or Word documents containing macros.

The GuLoader executable has been retrieved via embedded macros in malicious Word documents.

InvisiMole can deliver trojanized versions of software and documents, relying on user execution.

CLAIMLOADER has used tailored decoy documents as part of the installation routine to entice users to open attachments.

Mispadu has relied on users to execute malicious files in order to gain execution on victim machines.

RustyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.

DarkTortilla has relied on a user to open a malicious document or archived file delivered via email for initial execution.