Procedure examples

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.

Mustang Panda distributed hyperlinks that would result in an MSC file running a PowerShell command to download and install a remotely-hosted MSI file during RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.

During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.

Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.

During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.

During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.

During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.