Procedure examples

Malteiro has sent spearphishing emails containing malicious .zip files.

RTM has used spearphishing attachments to distribute its malware.

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

Tonto Team has delivered payloads via spearphishing attachments.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.

Moonstone Sleet delivered various payloads to victims as spearphishing attachments.

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.

APT30 has used spearphishing emails with malicious DOC attachments.

Rancor has attached a malicious document to an email to gain initial access.

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.

Ajax Security Team has used personalized spearphishing attachments.

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.

APT33 has sent spearphishing e-mails with archive attachments.

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.

Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.

Bumblebee has gained execution through luring users into opening malicious attachments.

KOPILUWAK has been delivered to victims as a malicious email attachment.

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.

Pony has been delivered via spearphishing attachments.

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.

AppleSeed has been distributed to victims through malicious e-mail attachments.

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.

EnvyScout has been distributed via spearphishing as an email attachment.

Emotet has been delivered by phishing emails containing attachments.

Woody RAT has been delivered via malicious Word documents and archive files.

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.

Snip3 has been delivered to victims through malicious e-mail attachments.

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

RustyWater has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.

IcedID has been delivered via phishing e-mails with malicious attachments.

Flagpro has been distributed via spearphishing as an email attachment.

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.

Javali has been delivered as malicious e-mail attachments.

Bisonal has been delivered as malicious email attachments.

Lumma Stealer has been delivered through phishing emails with malicious attachments.

Clambling has been delivered to victim's machines through malicious e-mail attachments.