Procedure examples

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.

During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.

During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.

For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

During Operation Dust Storm, the threat actors used Visual Basic scripts.

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called `vba_macro.exe`. This macro dropped `FONTCACHE.DAT`, the primary BlackEnergy implant; `rundll32.exe`, for executing the malware; `NTUSER.log`, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.

During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.

During FunnyDream, the threat actors used a Visual Basic script to run remote commands.

During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.

During Outer Space, OilRig used VBS droppers to deploy malware.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.