Phishing: Spearphishing Attachment

During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails. ^[2]

admin@338 has sent emails with malicious Microsoft Office documents attached.^[3]

The primary delivered mechanism for Agent Tesla is through email phishing messages.^[4]

Ajax Security Team has used personalized spearphishing attachments.^[5]

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.^[6][7]

AppleSeed has been distributed to victims through malicious e-mail attachments.^[8]

APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.^[9]

APT1 has sent spearphishing emails containing malicious attachments.^[10]

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.^[11][12]

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.^[13]

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.^{[14][15][16][17][18][19][20][21]}

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.^{[22][23][24][25]}

APT30 has used spearphishing emails with malicious DOC attachments.^[26]

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.^{[27][28][29][30][31][32]}

APT33 has sent spearphishing e-mails with archive attachments.^[33]

APT37 delivers malware using spearphishing emails with malicious HWP attachments.^[34][35][36]

APT38 has conducted spearphishing campaigns using malicious email attachments.^[37]

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.^[38][39][40]

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.^[41]

Astaroth has been delivered via malicious e-mail attachments.^[42]

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.^[43]

Bandook is delivered via a malicious Word document inside a zip file.^[44]

Bisonal has been delivered as malicious email attachments.^[45]

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.^[46][47]

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.^[48][49]

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.^[50]

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.^[51][52]

Bumblebee has gained execution through luring users into opening malicious attachments.^{[53][54][55][56]}

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.^[57]

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.^[58]

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.^[59]

Clambling has been delivered to victim's machines through malicious e-mail attachments.^[60]

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.^{[61][62][63][64][65][66][67][68]}

Confucius has crafted and sent victims malicious attachments to gain initial access.^[69]

CURIUM has used phishing with malicious attachments for initial access to victim environments.^[70]

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.^[71]

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.^[72]

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.^[73][74]

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.^[1][75][76]

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.^[77]

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.^[78]

Dragonfly has sent emails with malicious attachments to gain initial access.^[79]

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.^[80][81]

Emotet has been delivered by phishing emails containing attachments. ^{[82][83][84][85][86][87][88][89][90]}

EnvyScout has been distributed via spearphishing as an email attachment.^[91]

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.^[92][53]

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.^[93]

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.