Procedure examples

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.

Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.

Saint Bot has been distributed as malicious attachments within spearphishing emails.

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.

LODEINFO has been distributed to targeted victims via malicious email attachments.

Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Bandook is delivered via a malicious Word document inside a zip file.

KONNI has been delivered via spearphishing campaigns through a malicious Word document.

Kerrdown has been distributed through malicious e-mail attachments.

RTM has been delivered via spearphishing attachments disguised as PDF documents.

StrelaStealer has been distributed as a spearphishing attachment.

ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.

XLoader has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.

REvil has been distributed via malicious e-mail attachments including MS Word Documents.

Valak has been delivered via spearphishing e-mails with password protected ZIP files.

Taidoor has been delivered through spearphishing emails.

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.

Ramsay has been distributed through spearphishing emails with malicious attachments.

OutSteel has been distributed as a malicious attachment within a spearphishing email.

LAMEHUG has been distributed through spearphishing emails with various AI-themed malicious attachments.

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.

PoetRAT was distributed via malicious Word documents.

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.

Octopus has been delivered via spearsphishing emails.

Qilin has been delivered to victims through malicious email attachments.

The primary delivered mechanism for Agent Tesla is through email phishing messages.

Astaroth has been delivered via malicious e-mail attachments.

QakBot has spread through emails with malicious attachments.

Hancitor has been delivered via phishing emails with malicious attachments.

JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.

WarzoneRAT has been distributed as a malicious attachment within an email.

AsyncRAT has been delivered via malicious email attachments.

Remcos has been spread through emails containing malicious documents.

Kali365 has delivered phishing emails with malicious PDF, Word, Excel, and PowerPoint attachments that direct victims to actor-controlled landing pages.

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.

During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.

Mustang Panda distributed malicious links in phishing emails leading to HTML files that would direct the victim to malicious MSC files if running Windows based on User Agent fingerprinting during RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.

During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.

During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.

Pikabot Distribution February 2024 utilized emails with hyperlinks leading to malicious ZIP archive files containing scripts to download and install Pikabot.

During Operation AkaiRyū, MirrorFace sent spearphishing emails with malicious OneDrive links.

During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.

During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.

APT3 has sent spearphishing emails containing malicious links.

Mustard Tempest has sent victims emails containing links to compromised websites.

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.

EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.