Phishing: Spearphishing Attachment

admin@338 has sent emails with malicious Microsoft Office documents attached.^[1]

The primary delivered mechaism for Agent Tesla is through email phishing messages.^[2]

Ajax Security Team has used personalized spearphishing attachments.^[3]

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.^[4][5]

AppleSeed has been distributed to victims through malicious e-mail attachments.^[6]

APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.^[7]

APT1 has sent spearphishing emails containing malicious attachments.^[8]

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.^[9][10]

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.^[11]

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.^{[12][13][14][15][16][17][18][19]}

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.^{[20][21][22][23][24][25]}

APT30 has used spearphishing emails with malicious DOC attachments.^[26]

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.^{[27][28][29][30][31][32]}

APT33 has sent spearphishing e-mails with archive attachments.^[33]

APT37 delivers malware using spearphishing emails with malicious HWP attachments.^[34][35][36]

APT38 has conducted spearphishing campaigns using malicious email attachments.^[37]

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.^[38][39][40]

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.^[41]

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.^[42]

Bandook is delivered via a malicious Word document inside a zip file.^[43]

Bisonal has been delivered as malicious email attachments.^[44]

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.^[45][46]

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.^[47]

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.^[48][49]

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.^[50]

Clambling has been delivered to victim's machines through malicious e-mail attachments.^[51]

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.^{[52][53][54][55][56][57][58][59]}

Confucius has crafted and sent victims malicious attachments to gain initial access.^[60]

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.^[61][62]

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.^[63][64][65]

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.^[66]

Dragonfly has sent emails with malicious attachments to gain initial access.^[67]

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.^[68][69]

Emotet has been delivered by phishing emails containing attachments. ^{[70][71][72][73][74][75][76][77][78]}

EnvyScout has been distributed via spearphishing as an email attachment.^[79]

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.^[80]

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.^[81][82]

FIN6 has targeted victims with e-mails containing malicious attachments.^[83]

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.^{[84][85][86][87][88]}

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.^[89][90][91]

Flagpro has been distributed via spearphishing as an email attachment.^[46]

Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.^[92]

Gallmaker sent emails with malicious Microsoft Office documents attached.^[93]

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.^{[94][95][96][97][98][99]}

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.^[100]

Hancitor has been delivered via phishing emails with malicious attachments.^[101]

Higaisa has sent spearphishing emails containing malicious attachments.^[102][103]

IcedID has been delivered via phishing e-mails with malicious attachments.^[104]

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.^{[105][106][107][108]}

IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.^[109][110]

Javali has been delivered as malicious e-mail attachments.^[111]

JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.^[87]

Kerrdown has been distributed through malicious e-mail attachments.^[32]

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.^{[112][113][114][115][116][6][117][118]}

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.^[119]

KONNI has been delivered via spearphishing campaigns through a malicious Word document.^[120]

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.^{[121][122][123][124][125]}

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.^[119]

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.^[126][127]

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.^[128]

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.^{[129][130][131]}

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.^{[132][133][134][135]}

Metamorfo has been delivered to victims via emails with malicious HTML attachments.^[136][137]

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.^[138]

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.^{[139][140][141]}

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.^{[142][143][144][145][146][147]}

Mustang Panda has used spearphishing attachments to deliver initial access payloads.^{[148][149][150]}

Naikon has used malicious e-mail attachments to deliver malware.^[151]

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.^[152][153]

Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.^[154][155]

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.^[156]

Octopus has been delivered via spearsphishing emails.^[155]

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.^{[157][158][159]}

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.^{[160][161][162][163]}

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.^[164]

PoetRAT was distributed via malicious Word documents.^[165]

Pony has been delivered via spearphishing attachments.^[166]

QakBot has spread through emails with malicious attachments.^{[167][168][169][170][171][172][173]}

Ramsay has been distributed through spearphishing emails with malicious attachments.^[174]

Rancor has attached a malicious document to an email to gain initial access.^[175]

REvil has been distributed via malicious e-mail attachments including MS Word Documents.^{[176][177][178][179][180]}

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.^[181]

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.^[182]

RTM has been delivered via spearphishing attachments disguised as PDF documents.^[183]

RTM has used spearphishing attachments to distribute its malware.^[184]

Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.^{[185][186][187][188]}

Sharpshooter has sent malicious attachments via emails to targets.^[189]

Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.^[190]

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. ^{[191][192][193]}

TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.^[194]

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.^{[195][196][197][198][199][200][201][202][203]}

TA551 has sent spearphishing attachments with password protected ZIP files.^{[204][205][206]}

Taidoor has been delivered through spearphishing emails.^[207]

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.^[208]

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.^[51]

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.^[122]

Tonto Team has delivered payloads via spearphishing attachments.^[209]

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.^{[210][211][212][213][214]}

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware^[215]

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.^{[216][217][218][219][220]}

Valak has been delivered via spearphishing e-mails with password protected ZIP files.^[204]

WarzoneRAT has been distributed as a malicious attachment within an email.^[221][60]

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.^[222]

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.^[223]

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.^[224][225]

Anti-virus can also automatically quarantine suspicious files.

Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.

Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.^[226][227]

Users can be trained to identify social engineering techniques and spearphishing emails.