Command and Scripting Interpreter: Visual Basic

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.^[75]

APT32 has used macros, COM scriptlets, and VBS scripts.^[59][39]

APT33 has used VBScript to initiate the delivery of payloads.^[85]

APT37 executes shellcode and a VBA script to decode Base64 strings.^[62]

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.^[38]

Bisonal's dropper creates VBS scripts on the victim’s machine.^[8]

BRONZE BUTLER has used VBS and VBE scripts for execution.^[60][61]

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.^{[43][44][45][46][47][48]}

Cobalt Strike can use VBA to perform execution.^[6][7]

Comnie executes VBS scripts.^[31]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. ^{[21][22][23][24][25]}

Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.^[11]

FIN4 has used VBA macros to display a dialog box and collect victim credentials.^[49][50]

FIN7 used VBS scripts to help perform tasks on the victim's machine.^[63][64]

Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.^[77]

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.^[80][81]

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[39]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[51]

One version of Helminth consists of VBScript scripts.^[32]

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.^[65]

Inception has used VBScript to execute malicious commands and payloads.^[35][76]

JCry has used VBS scripts. ^[30]

jRAT has been distributed as HTA files with VBScript.^[33]

KeyBoy uses VBS scripts for installing files and performing execution.^[29]

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .^[5]

Leviathan has used VBScript.^[41]

Magic Hound malware has used VBS scripts for execution.^[40]

Molerats used various implants, including those built with VBScript, on target machines.^[78]

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.^{[66][67][68][69][12][70][71]}

NanHaiShu executes additional VBScript code on the victim's machine.^[18]

NanoCore uses VBS files.^[16]

OopsIE creates and uses a VBScript as part of its persistent execution.^[14][15]

OSX_OCEANLOTUS.D uses Word macros for execution.^[20]

Patchwork used Visual Basic Scripts (VBS) on victim machines.^[72][73]

PoetRAT has used Word documents with VBScripts to execute malicious activities.^[34]

PowerShower has the ability to save and execute VBScript.^[35]

POWERSTATS can use VBScript (VBE) code for execution.^[12][13]

QUADAGENT uses VBScripts.^[9]

Ramsay has included embedded Visual Basic Scripts in malicious documents.^[37]

Rancor has used VBS scripts as well as embedded macros for execution.^[74]

Remexi uses AutoIt and VBS scripts throughout its execution process.^[26]

Sandworm Team has created VBScripts to run an SSH server.^[82][83][84]

Sharpshooter's first-stage downloader was a VBA macro.^[79]

Silence has used VBS scripts.^[53]

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.^[19]

StoneDrill has several VBS scripts used throughout the malware's lifecycle.^[27]

TA459 has a VBScript for execution.^[42]

TA505 has used VBS for code execution.^{[54][55][56][57]}

Turla has used VBS scripts throughout its operations.^[58]

TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.^[10]

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.^[28]

VBShower has the ability to execute VBScript files.^[36]

WIRTE has used VBS scripts throughout its operation.^[52]

Xbash can execute malicious VBScript payloads on the victim’s machine.^[17]

Anti-virus can be used to automatically quarantine suspicious files.

Turn off or restrict access to unneeded VB components.

Use application control where appropriate.

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.