Procedure examples

FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.

Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.

Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.

Andariel has attempted to lure victims into enabling malicious macros within email attachments.

CURIUM has lured users into opening malicious files delivered via social media.

Sidewinder has lured targets to click on malicious files to gain execution in the target environment.

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

Contagious Interview has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.

TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.

APT37 has sent spearphishing attachments attempting to get a user to open them.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.

TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.

Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.

Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.

Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.

DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.

Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.

BlackTech has used e-mails with malicious documents to lure victims into installing malware.

Leviathan has sent spearphishing attachments attempting to get a user to click.

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.

RedCurl has used malicious files to infect the victim machines.

Mofang's malicious spearphishing attachments required a user to open the file after receiving.

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.

TA551 has prompted users to enable macros within spearphishing attachments to install malware.

Star Blizzard has lured targets into opening malicious .pdf files to deliver malware.

Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.

LazyScripter has lured users to open malicious email attachments.

Windshift has used e-mail attachments to lure victims into executing malicious code.

Whitefly has used malicious .exe or .dll files disguised as documents or images.

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

Malteiro has relied on users to execute .zip file attachments containing malicious URLs.

RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.

APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

Tonto Team has relied on user interaction to open their malicious RTF documents.

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Earth Lusca required users to click on a malicious file for the loader to activate.

FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).