Procedure examples

TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.

Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.

APT1 has sent spearphishing emails containing malicious attachments.

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.

Confucius has crafted and sent victims malicious attachments to gain initial access.

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.

Winter Vivern leverages malicious attachments delivered via email for initial access activity.

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.

RedCurl has used phishing emails with malicious files to gain initial access.

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.

TA551 has sent spearphishing attachments with password protected ZIP files.

Star Blizzard has sent emails with malicious .pdf files to spread malware.

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

Malteiro has sent spearphishing emails containing malicious .zip files.

RTM has used spearphishing attachments to distribute its malware.

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

Tonto Team has delivered payloads via spearphishing attachments.

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.

Moonstone Sleet delivered various payloads to victims as spearphishing attachments.

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.

APT30 has used spearphishing emails with malicious DOC attachments.

Rancor has attached a malicious document to an email to gain initial access.

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.

Ajax Security Team has used personalized spearphishing attachments.

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.

APT33 has sent spearphishing e-mails with archive attachments.

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.

Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.

APT3 has sent spearphishing emails containing malicious links.