Procedure examples

APT38 has used VBScript to execute commands and other operational tasks.

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.

Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure. Kimsuky has also leveraged VBScript (VBS) scripts to execute temp.vbs every 19 minutes using a scheduled task to run QuasarRAT.

Patchwork used Visual Basic Scripts (VBS) on victim machines.

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.

APT32 has used macros, COM scriptlets, and VBS scripts.

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.

FIN7 used VBS scripts to help perform tasks on the victim's machine.

Sandworm Team has created VBScripts to run an SSH server.

Machete has embedded malicious macros within spearphishing attachments to download additional files.

Sidewinder has used VBScript to drop and execute malware loaders.

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.

APT39 has utilized malicious VBS scripts in malware.

Contagious Interview has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.

TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.

APT37 executes shellcode and a VBA script to decode Base64 strings.

OilRig has used VBScript macros for execution on compromised hosts.

Higaisa has used VBScript code on the victim's machine.

TA459 has a VBScript for execution.

Confucius has used VBScript to execute malicious code.

Leviathan has used VBScript.

Turla has used VBS scripts throughout its operations.

TA505 has used VBS for code execution.

RedCurl has used VBScript to run malicious files.

MirrorFace has used remote templates with VBA code in malware infection chains.

BRONZE BUTLER has used VBS and VBE scripts for execution.

LazyScripter has used VBScript to execute malicious code.

Windshift has used Visual Basic 6 (VB6) payloads.

Malteiro has utilized a dropper containing malicious VBS scripts.

APT42 has used a VBScript to query anti-virus products.

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Earth Lusca used VBA scripts.

FIN4 has used VBA macros to display a dialog box and collect victim credentials.

Silence has used VBS scripts.

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Molerats used various implants, including those built with VBScript, on target machines.

Transparent Tribe has crafted VBS-based malicious documents.

Inception has used VBScript to execute malicious commands and payloads.

HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.

Rancor has used VBS scripts as well as embedded macros for execution.

WIRTE has used VBScript in its operations.

Magic Hound malware has used VBS scripts for execution.

APT33 has used VBScript to initiate the delivery of payloads.

FIN13 has used VBS scripts for code execution on comrpomised machines.