Procedure examples

GuLoader has been spread in phishing campaigns using malicious web links.

Mispadu has been spread via malicious links embedded in emails.

SocGholish has been spread via emails containing malicious links.

SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.

Javali has been delivered via malicious links embedded in e-mails.

Lumma Stealer has been delivered through phishing emails containing malicious links.

DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files. DarkGate uses applications such as Microsoft Teams for distributing links to payloads.

Latrodectus has been distributed to victims through emails containing malicious links.

Saint Bot has been distributed through malicious links contained within spearphishing emails.

Kerrdown has been distributed via e-mails containing a malicious link.

Grandoreiro has been spread via malicious links embedded in e-mails.

Bazar has been spread via emails with embedded malicious links.

Valak has been delivered via malicious links in e-mail.

OutSteel has been distributed through malicious links contained within spearphishing emails.

Melcoz has been spread through malicious links embedded in e-mails.

KOCTOPUS has been distributed as a malicious link within an email.

Qilin has been delivered via malicious links in spearphishing emails.

AppleJeus has been distributed via spearphishing link.

QakBot has spread through emails with malicious links.

Hancitor has been delivered via phishing emails which contained malicious links.

AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.

Kali365 has sent bulk phishing emails containing malicious hyperlinks that direct victims to actor-controlled landing pages impersonating services including SharePoint, OneDrive, Teams, DocuSign, and Adobe Acrobat Sign.

During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.

EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.

Storm-1811 has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.

CURIUM has used social media to deliver malicious files to victims.

Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.

OilRig has used LinkedIn to send spearphishing links.

APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.

Dark Caracal spearphished victims via Facebook and Whatsapp.

Windshift has used fake personas on social media to engage and target victims.

ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.

Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.

Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.

Ajax Security Team has used various social media channels to spearphish victims.

Ninja has been distributed to victims via the messaging app Telegram.

During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls to direct victims to download a remote monitoring and management (RMM) tool that would allow the adversary to remotely control their system.

Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.

During the Anthropic AI-orchestrated Campaign, the adversary utilized Claude Code to generate a detailed summary report of collected data, which is then reviewed and approved by the adversary prior to exfiltration of data over Claude.

During Salesforce Data Exfiltration, threat actors exfiltrated data via legitimate Salesforce API communication channels including the Salesforce Data Loader application.

During APT28 Nearest Neighbor Campaign, APT28 exfiltrated data over public-facing webservers – such as Google Drive.

During C0017, APT41 used Cloudflare services for data exfiltration.

BlackByte has used services such as `anonymfiles.com` and `file.io` to exfiltrate victim data.

Contagious Interview has leveraged Telegram API to exfiltrate stolen data.

APT28 can exfiltrate data over Google Drive.

Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.

InvisibleFerret has leveraged Telegram chat to upload stolen data using the Telegram API with a bot token.

AppleSeed has exfiltrated files using web services.