User Execution: Malicious File

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.^[90]

Agent Tesla has been executed through malicious e-mail attachments ^[15]

APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.^[94]

APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.^[88][89]

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.^[23]

APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.^[28][29]

APT29 has used various forms of spearphishing attempting to get a user to open links or attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. ^{[32] [33]}

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.^{[66][67][68][69]}

APT33 has used malicious e-mail attachments to lure victims into executing malware.^[111]

APT37 has sent spearphishing attachments attempting to get a user to open them.^[26]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment. ^[72][73][74]

BlackTech has used e-mails with malicious documents to lure victims into installing malware.^[13]

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.^[24][25]

Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.^[20]

Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.^[3]

CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.^[1]

Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.^[30][31]

Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.^[27]

Darkhotel sent spearphishing emails with malicious attachments that required users to click on an image in the document to drop the malware to disk.^[47]

DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.^[45][46]

Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open attachments.^[21][22]

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.^[48][49]

Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.^[9][10]

FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).^[43][44]

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.^[42]

FIN8 has leveraged Spearphishing Attachments attempting to gain User Execution.^[34][35][36]

Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.^[100]

Gallmaker sent victims a lure document with a warning that asked victims to "enable content" for execution.^[64]

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.^[105][106]

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.^[50]

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.^{[95][96][97][98]}

JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer. ^[5]

Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.^[65]

Leviathan has sent spearphishing attachments attempting to get a user to click.^[57]

Lokibot has been executed through malicious documents contained in spearphishing e-mails.^[14]

Machete has has relied on users opening malicious attachments delivered through spearphishing to execute malware.^[91][92][93]

Magic Hound has lured victims into executing malicious files.^[113]

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.^{[37][38][39][40][41]}

Mofang's malicious spearphishing attachments required a user to open the file after receiving.^[101]

Molerats has sent malicious files via email.^[103]

MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.^{[58][59][60][61][62][63]}

Naikon has convinced victims to open malicious attachments to execute malware.^[109]

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.^[52][53][54]

OSX/Shlayer relies on users mounting and executing a malicious DMG file.^[7][8]

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.^[55][56]

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.^[71]

PLEAD has been executed via malicious e-mail attachments.^[13]

PoetRAT has used spearphishing attachments to infect victims.^[11]

Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).^[16]

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.^[70]

Rifdoor has been executed from malicious Excel or Word documents containing macros.^[12]

RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.^[18]

RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.^[99]

Sandworm Team has delivered spearphishing attachments with malicious macros embedded within files.^[110]

Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user.^[104]

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.^[76][77][78]

SQLRat relies on users clicking on an embedded image to execute the scripts.^[6]

SYSCON has been executed by luring victims to open malicious e-mail attachments.^[17]

TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.^[51]

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. ^{[79][80][81][82][83][84][85][86][87]}

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.^[75]

TrickBot has attempted to get users to launch a malicious Excel attachment to deliver its payload. ^[4]

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.^[107]

A Word document delivering TYPEFRAME prompts the user to enable macro execution.^[2]

Valak has been executed via Microsoft Word documents containing malicious macros.^[19]

Whitefly has used malicious .exe or .dll files disguised as documents or images.^[108]

Windshift has used e-mail attachments to lure victims into executing malicious code.^[112]

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, or TrickBot.^[102]

Application control may be able to prevent the running of executables masquerading as other files.

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.