Procedure examples

During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.

Mustang Panda distributed malicious links in phishing emails leading to HTML files that would direct the victim to malicious MSC files if running Windows based on User Agent fingerprinting during RedDelta Modified PlugX Infection Chain Operations.

During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.

During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.

During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.

Pikabot Distribution February 2024 utilized emails with hyperlinks leading to malicious ZIP archive files containing scripts to download and install Pikabot.

During Operation AkaiRyū, MirrorFace sent spearphishing emails with malicious OneDrive links.

During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.

During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.