Procedure examples

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.

Bumblebee has gained execution through luring users into opening malicious attachments.

KOPILUWAK has been delivered to victims as a malicious email attachment.

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.

Pony has been delivered via spearphishing attachments.

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.

AppleSeed has been distributed to victims through malicious e-mail attachments.

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.

EnvyScout has been distributed via spearphishing as an email attachment.

Emotet has been delivered by phishing emails containing attachments.

Woody RAT has been delivered via malicious Word documents and archive files.

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.

Snip3 has been delivered to victims through malicious e-mail attachments.

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

RustyWater has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.

IcedID has been delivered via phishing e-mails with malicious attachments.

Flagpro has been distributed via spearphishing as an email attachment.

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.

Javali has been delivered as malicious e-mail attachments.

Bisonal has been delivered as malicious email attachments.

Lumma Stealer has been delivered through phishing emails with malicious attachments.

Clambling has been delivered to victim's machines through malicious e-mail attachments.

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.

Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.

Saint Bot has been distributed as malicious attachments within spearphishing emails.

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.

LODEINFO has been distributed to targeted victims via malicious email attachments.

Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Bandook is delivered via a malicious Word document inside a zip file.

KONNI has been delivered via spearphishing campaigns through a malicious Word document.

Kerrdown has been distributed through malicious e-mail attachments.

RTM has been delivered via spearphishing attachments disguised as PDF documents.

StrelaStealer has been distributed as a spearphishing attachment.

ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.

XLoader has been delivered as a phishing attachment, including PDFs with embedded links, Word and Excel files, and various archive files (ZIP, RAR, ACE, and ISOs) containing EXE payloads.

REvil has been distributed via malicious e-mail attachments including MS Word Documents.

Valak has been delivered via spearphishing e-mails with password protected ZIP files.

Taidoor has been delivered through spearphishing emails.

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.

Ramsay has been distributed through spearphishing emails with malicious attachments.

OutSteel has been distributed as a malicious attachment within a spearphishing email.

LAMEHUG has been distributed through spearphishing emails with various AI-themed malicious attachments.

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.

PoetRAT was distributed via malicious Word documents.

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.

Octopus has been delivered via spearsphishing emails.