Procedure examples

TA577 has sent emails containing links to malicious JavaScript files.

Patchwork has used spearphishing with links to deliver files with exploits to initial victims.

Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.

APT32 has sent spearphishing emails containing malicious links.

MuddyWater has sent targeted spearphishing e-mails with malicious links.

Storm-1811 has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.

FIN7 has conducted broad phishing campaigns using malicious links. Additionally, FIN7 has sent spearphishing emails containing a typosquatted link to “ip-sccanner[.]com.”

Sandworm Team has crafted phishing emails containing malicious hyperlinks.

Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.

Sidewinder has sent e-mails with malicious links often crafted for specific targets.

Mustang Panda has delivered malicious links to their intended targets. Mustang Panda has distributed spear-phishing emails with embedded links that direct the victim to a malicious archive hosted on Google or Dropbox.

ZIRCONIUM has used malicious links in e-mails to deliver malware.

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.

TA2541 has used spearphishing e-mails with malicious links to deliver malware.

OilRig has sent spearphising emails with malicious links to potential victims.

APT1 has sent spearphishing emails containing hyperlinks to malicious files.

Confucius has sent malicious links to victims through email campaigns.

BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.

TA505 has sent spearphishing emails containing malicious links.

RedCurl has used phishing emails with malicious links to gain initial access.

Mofang delivered spearphishing emails with malicious links included.

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.

MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.

LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.

LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.

APT42 has sent spearphishing emails containing malicious links.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

Lazarus Group has sent malicious links to victims via email.

Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.

FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.

Cobalt Group has sent emails with URLs pointing to malicious documents.

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Molerats has sent phishing emails with malicious links included.

Transparent Tribe has embedded links to malicious downloads in e-mails.

WIRTE has sent targeted spearphishing emails with malicious links directing victims to malware downloads.

Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.

APT33 has sent spearphishing emails containing links to .hta files.

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.

TrickBot has been delivered via malicious links in phishing e-mails.

Bumblebee has been spread through e-mail campaigns with malicious links.

Havoc has been distributed through ClickFix phishing campaigns.

Pony has been delivered via spearphishing emails which contained malicious links.

ROAMINGHOUSE has been distributed through phishing emails containing malicious OneDrive links.

NETWIRE has been spread via e-mail campaigns utilizing malicious links.

Emotet has been delivered by phishing emails containing links.

Squirrelwaffle has been distributed through phishing emails containing a malicious URL.

Snip3 has been delivered to victims through e-mail links to malicious files.