Procedure examples

Mustard Tempest has sent victims emails containing links to compromised websites.

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.

EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.

TA577 has sent emails containing links to malicious JavaScript files.

Patchwork has used spearphishing with links to deliver files with exploits to initial victims.

Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.

APT32 has sent spearphishing emails containing malicious links.

MuddyWater has sent targeted spearphishing e-mails with malicious links.

Storm-1811 has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.

FIN7 has conducted broad phishing campaigns using malicious links. Additionally, FIN7 has sent spearphishing emails containing a typosquatted link to “ip-sccanner[.]com.”

Sandworm Team has crafted phishing emails containing malicious hyperlinks.

Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.

Sidewinder has sent e-mails with malicious links often crafted for specific targets.

Mustang Panda has delivered malicious links to their intended targets. Mustang Panda has distributed spear-phishing emails with embedded links that direct the victim to a malicious archive hosted on Google or Dropbox.

ZIRCONIUM has used malicious links in e-mails to deliver malware.

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.

TA2541 has used spearphishing e-mails with malicious links to deliver malware.

OilRig has sent spearphising emails with malicious links to potential victims.

APT1 has sent spearphishing emails containing hyperlinks to malicious files.

Confucius has sent malicious links to victims through email campaigns.

BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.

TA505 has sent spearphishing emails containing malicious links.

RedCurl has used phishing emails with malicious links to gain initial access.

Mofang delivered spearphishing emails with malicious links included.

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.

MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.

LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.

LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.

APT42 has sent spearphishing emails containing malicious links.

APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.

Lazarus Group has sent malicious links to victims via email.

Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.

FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.

Cobalt Group has sent emails with URLs pointing to malicious documents.

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Molerats has sent phishing emails with malicious links included.

Transparent Tribe has embedded links to malicious downloads in e-mails.

WIRTE has sent targeted spearphishing emails with malicious links directing victims to malware downloads.

Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.

APT33 has sent spearphishing emails containing links to .hta files.

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.

EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.

Storm-1811 has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.

CURIUM has used social media to deliver malicious files to victims.

Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.

OilRig has used LinkedIn to send spearphishing links.