User Execution: Malicious Link

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.^[40]

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.^[7][8]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link. ^[11]

BackConfig has compromised victims via links to URLs hosting malicious content.^[6]

BlackTech has used e-mails with malicious links to lure victims into installing malware.^[3]

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.^[12][13]

Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links.^[14][15]

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.^[16][17]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.^[1][2]

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).^[18][19]

FIN8 has leveraged Spearphishing Links attempting to gain User Execution.^[20][21][22]

Leviathan has sent spearphishing email links attempting to get a user to click.^[23]

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.^[24][25][26]

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.^[38]

Molerats has sent malicious links via email.^[39]

Night Dragon enticed users to click on links in spearphishing emails to download malware.^[10]

OilRig has delivered malicious links to achieve execution on the target system.^[27][28][29]

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.^{[42][43][44][6]}

PLEAD has been executed via malicious links in e-mails.^[3]

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.^[5]

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. ^{[30][31][32][33][34][35][36][37]}

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.^[4]

Turla has used spearphishing via a link to get users to download and run their malware.^[9]

Windshift has used links embedded in e-mails to lure victims into executing malicious code.^[41]

If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.

If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.