Procedure examples

Patchwork leveraged the DDE protocol to deliver their malware.

MuddyWater has used malware that can execute PowerShell scripts via DDE.

Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.

APT37 has used Windows DDE for execution of commands and a malicious VBS.

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

TA505 has leveraged malicious Word documents that abused DDE.

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

Cobalt Group has sent malicious Word OLE compound documents to victims.