Command and Scripting Interpreter: Visual Basic

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called vba_macro.exe. This macro dropped FONTCACHE.DAT, the primary BlackEnergy implant; rundll32.exe, for executing the malware; NTUSER.log, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines. ^[7]

During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.^[8]

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.^[9]

APT32 has used macros, COM scriptlets, and VBS scripts.^[10][11]

APT33 has used VBScript to initiate the delivery of payloads.^[12]

APT37 executes shellcode and a VBA script to decode Base64 strings.^[13]

APT38 has used VBScript to execute commands and other operational tasks.^[14]

APT39 has utilized malicious VBS scripts in malware.^[15]

Astaroth has used malicious VBS e-mail attachments for execution.^[16]

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.^[17]

Bandook has used malicious VBA code against the target system.^[18]

Bisonal's dropper creates VBS scripts on the victim’s machine.^[19][20]

BRONZE BUTLER has used VBS and VBE scripts for execution.^[21][22]

Bumblebee can create a Visual Basic script to enable persistence.^[23][24]

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.^[25]

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.^[26]

Chaes has used VBscript to execute malicious code.^[27]

CHIMNEYSWEEP has executed a script named cln.vbs on compromised hosts.^[28]

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.^{[29][30][31][32][33][34]}

Cobalt Strike can use VBA to perform execution.^[35][36][37]

Comnie executes VBS scripts.^[38]

Confucius has used VBScript to execute malicious code.^[39]

DanBot can use a VBA macro embedded in an Excel file to drop the payload.^[40]

DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.^[41]

Donut can generate shellcode outputs that execute via VBScript.^[42]

Earth Lusca used VBA scripts.^[43]

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads. ^{[44][45][46][47][48]}

Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.^[49]

Ferocious has the ability to use Visual Basic scripts for execution.^[50]

FIN13 has used VBS scripts for code execution on comrpomised machines.^[51]

FIN4 has used VBA macros to display a dialog box and collect victim credentials.^[52][53]

FIN7 used VBS scripts to help perform tasks on the victim's machine.^[54][55][56]

Flagpro can execute malicious VBA macros embedded in .xlsm files.^[57]

During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.^[58]

During FunnyDream, the threat actors used a Visual Basic script to run remote commands.^[59]

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.^{[60][61][62][63][64]}

Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.^[11]

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.^[65]

Grandoreiro can use VBScript to execute malicious code.^[16][66]

One version of Helminth consists of VBScript scripts.^[67]

HEXANE has used a VisualBasic script named MicrosoftUpdator.vbs for execution of a PowerShell keylogger.^[68]

Higaisa has used VBScript code on the victim's machine.^[69]

IcedID has used obfuscated VBA string expressions.^[70]

Inception has used VBScript to execute malicious commands and payloads.^[71][72]

IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.^[73]

Javali has used embedded VBScript to download malicious payloads from C2.^[16]

JCry has used VBS scripts. ^[74]

jRAT has been distributed as HTA files with VBScript.^[75]

JSS Loader can download and execute VBScript files.^[56]

Kerrdown can use a VBS base64 decoder function published by Motobit.^[76]

KeyBoy uses VBS scripts for installing files and performing execution.^[77]

Kimsuky has used Visual Basic to download malicious payloads.^{[78][79][80][81]} Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.^[81]

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .^[82]

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.^[83]

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.^[84][85]

LazyScripter has used VBScript to execute malicious code.^[83]

Leviathan has used VBScript.^[86]

Lokibot has used VBS scripts and XLS macros for execution.^[87]

LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.^[88]

LunarMail has been installed using a VBA macro.^[89]

Machete has embedded malicious macros within spearphishing attachments to download additional files.^[90]

Magic Hound malware has used VBS scripts for execution.^[91]

Malteiro has utilized a dropper containing malicious VBS scripts.^[92]

Melcoz can use VBS scripts to execute malicious DLLs.^[16]

Metamorfo has used VBS code on victims’ systems.^[93]

Mispadu’s dropper uses VBS files to install payloads and perform execution.^[92][94]

Molerats used various implants, including those built with VBScript, on target machines.^[95][96]

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.^{[97][98][99][100][101][102][103][104][105]}

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.^{[106][107][108]}

NanHaiShu executes additional VBScript code on the victim's machine.^[109]

NanoCore uses VBS files.^[110]

NETWIRE has been executed through use of VBScripts.^[111][112]

OilRig has used VBScript macros for execution on compromised hosts.^[113]

OopsIE creates and uses a VBScript as part of its persistent execution.^[114][115]

During Operation CuckooBees, the threat actors executed an encoded VBScript file using wscript and wrote the decoded output to a text file.^[116]

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.^[117][118]

During Operation Dust Storm, the threat actors used Visual Basic scripts.^[119]

For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.^[120]

During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.^[121]

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.^[122]

OSX_OCEANLOTUS.D uses Word macros for execution.^[123]

Patchwork used Visual Basic Scripts (VBS) on victim machines.^[124][125]

PoetRAT has used Word documents with VBScripts to execute malicious activities.^[126][127]

PowerShower has the ability to save and execute VBScript.^[71]

POWERSTATS can use VBScript (VBE) code for execution.^[101][128]

Pteranodon can use a malicious VBS file for execution.^[129]

QakBot can use VBS to download and execute malicious files.^{[130][131][132][133][134][135][136]}

QUADAGENT uses VBScripts.^[137]

Ramsay has included embedded Visual Basic scripts in malicious documents.^[138][139]

Rancor has used VBS scripts as well as embedded macros for execution.^[140]

RedCurl has used VBScript to run malicious files.^[141][142]

Remexi uses AutoIt and VBS scripts throughout its execution process.^[143]

REvil has used obfuscated VBA macros for execution.^[144][145]

ROKRAT has used Visual Basic for execution.^[146]

Saint Bot has used .vbs scripts for execution.^[147]

Sandworm Team has created VBScripts to run an SSH server.^{[148][149][150][8]}

Sibot executes commands using VBScript.^[151]

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling mshta.exe.^[152]

Sidewinder has used VBScript to drop and execute malware loaders.^[153]

Silence has used VBS scripts.^[154]

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.^[155]

Snip3 can use visual basic scripts for first-stage execution.^[156][157]

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.^[158]

Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an AutoOpen subroutine.^[159][160]

STARWHALE can use the VBScript function GetRef as part of its persistence mechanism.^[161]

StoneDrill has several VBS scripts used throughout the malware's lifecycle.^[162]

SUNBURST used VBScripts to initiate the execution of payloads.^[163]

SVCReady has used VBA macros to execute shellcode.^[164]

TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.^[165][166]

TA459 has a VBScript for execution.^[167]

TA505 has used VBS for code execution.^{[168][169][170][171]}

Transparent Tribe has crafted VBS-based malicious documents.^[172][173]

Turla has used VBS scripts throughout its operations.^[174]

TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.^[175]

Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.^[176]

VBShower has the ability to execute VBScript files.^[177]

WhisperGate can use a Visual Basic script to exclude the C:\ drive from Windows Defender.^[178][179]

Windshift has used Visual Basic 6 (VB6) payloads.^[180]

WIRTE has used VBScript in its operations.^[181]

Xbash can execute malicious VBScript payloads on the victim’s machine.^[182]

Anti-virus can be used to automatically quarantine suspicious files.

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content ^[183].

Turn off or restrict access to unneeded VB components.

Use application control where appropriate. VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.^[6]

Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process. For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.