Procedure examples

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder. Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

Contagious Interview has lured victims to click on a malicious link that led to download of a malicious payload. Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.

TA2541 has used malicious links to cloud and web services to gain execution on victim machines.

OilRig has delivered malicious links to achieve execution on the target system.

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Confucius has lured victims into clicking on a malicious link sent through spearphishing.

BlackTech has used e-mails with malicious links to lure victims into installing malware.

Leviathan has sent spearphishing email links attempting to get a user to click.

Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.

Turla has used spearphishing via a link to get users to download and run their malware.

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

RedCurl has used malicious links to infect the victim machines.

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.

APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.

TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.

LazyScripter has relied upon users clicking on links to malicious files.

Windshift has used links embedded in e-mails to lure victims into executing malicious code.

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.

Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Transparent Tribe has directed users to open URLs hosting malicious content.

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.

WIRTE has used links embedded in emails to lure users into downloading malicious files.

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.

FIN8 has used emails with malicious links to lure victims into installing malware.

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

Indrik Spider has attempted to get users to click on a malicious zipped file.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.

Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

Naikon has convinced victims to open malicious attachments to execute malware.