Procedure examples

APT38 has used links to execute a malicious Visual Basic script.

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.

APT3 has lured victims into clicking malicious links delivered through spearphishing.

Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.

Kimsuky has lured victims into clicking malicious links.

EXOTIC LILY has used malicious links to lure users into executing malicious payloads.

TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.

FIN7 has used malicious links to lure victims into downloading malware.

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder. Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

Contagious Interview has lured victims to click on a malicious link that led to download of a malicious payload. Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.

TA2541 has used malicious links to cloud and web services to gain execution on victim machines.

OilRig has delivered malicious links to achieve execution on the target system.

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Confucius has lured victims into clicking on a malicious link sent through spearphishing.

BlackTech has used e-mails with malicious links to lure victims into installing malware.

Leviathan has sent spearphishing email links attempting to get a user to click.

Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.

Turla has used spearphishing via a link to get users to download and run their malware.

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

RedCurl has used malicious links to infect the victim machines.

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.

APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.

TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.

LazyScripter has relied upon users clicking on links to malicious files.

Windshift has used links embedded in e-mails to lure victims into executing malicious code.

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.

Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Transparent Tribe has directed users to open URLs hosting malicious content.

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.

WIRTE has used links embedded in emails to lure users into downloading malicious files.

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.

FIN8 has used emails with malicious links to lure victims into installing malware.