Procedure examples

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).

Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.

Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.

Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.

UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of `SYSTEM`.

Higaisa has exploited CVE-2018-0798 for execution.

Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.

Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.

TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.

Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.

Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.

Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.

BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.

Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.

APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.

APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).

Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.

Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.

Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).

ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.

Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.

LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.

APT38 has used links to execute a malicious Visual Basic script.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.

APT3 has lured victims into clicking malicious links delivered through spearphishing.

Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.

Kimsuky has lured victims into clicking malicious links.

EXOTIC LILY has used malicious links to lure users into executing malicious payloads.

TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.

FIN7 has used malicious links to lure victims into downloading malware.