Command and Scripting Interpreter: Visual Basic

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.^[7]

APT29 has written malware variants in Visual Basic.^[8]

APT32 has used macros, COM scriptlets, and VBS scripts.^[9][10]

APT33 has used VBScript to initiate the delivery of payloads.^[11]

APT37 executes shellcode and a VBA script to decode Base64 strings.^[12]

APT38 has used VBScript to execute commands and other operational tasks.^[13]

APT39 has utilized malicious VBS scripts in malware.^[14]

Astaroth has used malicious VBS e-mail attachments for execution.^[15]

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.^[16]

Bandook has used malicious VBA code against the target system.^[17]

Bisonal's dropper creates VBS scripts on the victim’s machine.^[18][19]

BRONZE BUTLER has used VBS and VBE scripts for execution.^[20][21]

Chaes has used VBscript to execute malicious code.^[22]

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.^{[23][24][25][26][27][28]}

Cobalt Strike can use VBA to perform execution.^[29][30][31]

Comnie executes VBS scripts.^[32]

Confucius has used VBScript to execute malicious code.^[33]

Donut can generate shellcode outputs that execute via VBScript.^[34]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. ^{[35][36][37][38][39]}

Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.^[40]

Ferocious has the ability to use Visual Basic scripts for execution.^[41]

FIN4 has used VBA macros to display a dialog box and collect victim credentials.^[42][43]

FIN7 used VBS scripts to help perform tasks on the victim's machine.^[44][45][46]

Flagpro can execute malicious VBA macros embedded in .xlsm files.^[47]

Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.^[48]

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.^{[49][50][51][52][53]}

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[10]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[54]

Grandoreiro can use VBScript to execute malicious code.^[15][55]

One version of Helminth consists of VBScript scripts.^[56]

Higaisa has used VBScript code on the victim's machine.^[57]

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.^[58]

IcedID has used obfuscated VBA string expressions.^[59]

Inception has used VBScript to execute malicious commands and payloads.^[60][61]

Javali has used embedded VBScript to download malicious payloads from C2.^[15]

JCry has used VBS scripts. ^[62]

jRAT has been distributed as HTA files with VBScript.^[63]

JSS Loader can download and execute VBScript files.^[46]

Kerrdown can use a VBS base64 decoder function published by Motobit.^[64]

KeyBoy uses VBS scripts for installing files and performing execution.^[65]

Kimsuky has used Visual Basic to download malicious payloads.^{[66][67][68][69]} Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.^[69]

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .^[70]

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.^[71]

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.^{[72][73][74][75]}

LazyScripter has used VBScript to execute malicious code.^[71]

Leviathan has used VBScript.^[76]

Lokibot has used VBS scripts and XLS macros for execution.^[77]

LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.^[78]

Machete has embedded malicious macros within spearphishing attachments to download additional files.^[79]

Magic Hound malware has used VBS scripts for execution.^[80]

Melcoz can use VBS scripts to execute malicious DLLs.^[15]

Metamorfo has used VBS code on victims’ systems.^[81]

Molerats used various implants, including those built with VBScript, on target machines.^[82][83]

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.^{[84][85][86][87][88][89][90][91]}

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.^[92][93][94]

NanHaiShu executes additional VBScript code on the victim's machine.^[95]

NanoCore uses VBS files.^[96]

NETWIRE has been executed through use of VBScripts.^[97][98]

OilRig has used VBSscipt macros for execution on compromised hosts.^[99]

OopsIE creates and uses a VBScript as part of its persistent execution.^[100][101]

Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.^[102]

OSX_OCEANLOTUS.D uses Word macros for execution.^[103]

Patchwork used Visual Basic Scripts (VBS) on victim machines.^[104][105]

PoetRAT has used Word documents with VBScripts to execute malicious activities.^[106][107]

PowerShower has the ability to save and execute VBScript.^[60]

POWERSTATS can use VBScript (VBE) code for execution.^[88][108]

Pteranodon can use a malicious VBS file for execution.^[109]

QakBot can use VBS to download and execute malicious files.^{[110][111][112][113][114][115]}

QUADAGENT uses VBScripts.^[116]

Ramsay has included embedded Visual Basic scripts in malicious documents.^[117][118]

Rancor has used VBS scripts as well as embedded macros for execution.^[119]

Remexi uses AutoIt and VBS scripts throughout its execution process.^[120]

REvil has used obfuscated VBA macros for execution.^[121][122]

ROKRAT has used Visual Basic for execution.^[123]

Sandworm Team has created VBScripts to run an SSH server.^{[124][125][126][127]}

Sharpshooter's first-stage downloader was a VBA macro.^[128]

Sibot executes commands using VBScript.^[129]

Sidewinder has used VBScript to drop and execute malware loaders.^[130]

Silence has used VBS scripts.^[131]

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.^[132]

StoneDrill has several VBS scripts used throughout the malware's lifecycle.^[133]

SUNBURST used VBScripts to initiate the execution of payloads.^[134]

TA459 has a VBScript for execution.^[135]

TA505 has used VBS for code execution.^{[136][137][138][139]}

Transparent Tribe has crafted VBS-based malicious documents.^[140][141]

Turla has used VBS scripts throughout its operations.^[142]

TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.^[143]

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.^[144]

VBShower has the ability to execute VBScript files.^[145]

WhisperGate can use a Visual Basic script to exclude the C:\ drive from Windows Defender.^[146][147]

Windshift has used Visual Basic 6 (VB6) payloads.^[148]

WIRTE has used VBScript in its operations.^[149]

Xbash can execute malicious VBScript payloads on the victim’s machine.^[150]

Anti-virus can be used to automatically quarantine suspicious files.

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content ^[151].

Turn off or restrict access to unneeded VB components.

Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.^[6]

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.