Procedure examples

During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.

During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.

Mustang Panda distributed malicious LNK objects for user execution during RedDelta Modified PlugX Infection Chain Operations.

During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.

During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.

During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.

During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them.

During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.

Water Curupira Pikabot Distribution delivered Pikabot installers as password-protected ZIP files containing heavily obfuscated JavaScript, or IMG files containing an LNK mimicking a Word document and a malicious DLL.

During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.

During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments.

During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.