Procedure examples

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.

During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.

Mustang Panda leveraged malicious attachments in spearphishing emails for initial access to victim environments in RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.

During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.

During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.

Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers.

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.

During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.