Scripting

Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.

Scripts can be embedded inside Office documents as macros that can be set to execute when files used in Spearphishing Attachment and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through Exploitation for Client Execution, where adversaries will rely on macros being allowed or that the user will accept to activate them.

Many popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. [1] [1], [2] [2], and PowerSploit [3] are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. [4]

ID: T1064

Tactic: Defense Evasion, Execution

Platform:  Linux, macOS, Windows

Permissions Required:  User

Data Sources:  Process monitoring, File monitoring, Process command-line parameters

Defense Bypassed:  Process whitelisting, Data Execution Prevention, Exploit Prevention

Version: 1.0

Examples

NameDescription
APT1

APT1 has used batch scripting to automate execution of commands.[5]

APT19

APT19 downloaded and launched code within a SCT file.[6]

APT28

An APT28 loader Trojan uses a batch script to run its payload.The group has also used macros to execute payloads.(citation: Unit42 Cannon Nov 2018)[7][8]

APT29

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke, as well as to evade defenses.[9][10]

APT3

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.[11]

APT32

APT32 has used macros, PowerShell scripts, COM scriptlets, and VBS scripts.[12][13]

APT37

APT37 executes shellcode and a script to decode Base64 strings.[14]

APT39

APT39 utilized custom scripts to perform internal reconnaissance.[15]

Astaroth

Astaroth uses JavaScript to perform its core functionalities.[16]

Bisonal

Bisonal's dropper creates VBS scripts on the victim’s machine.[17]

BRONZE BUTLER

BRONZE BUTLER has used VBS, VBE, and batch scripts for execution.[18]

China Chopper

China Chopper's server component is a text based payload available in a variety of scripting languages. [19]

Cobalt Group

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution and executed JavaScript scriptlets on the victim's machine. The group has also used an exploit toolkit known as Threadkit that launches .bat files.[20][21][22][23][24][25]

Cobalt Strike

Cobalt Strike can use PowerSploit or other scripting frameworks to perform execution.[26]

CoinTicker

CoinTicker executes a bash script to establish a reverse shell and a Python script to download its second stage.[27]

Comnie

Comnie executes BAT and VBS scripts.[28]

Dark Caracal

Dark Caracal has used macros in Word documents that would download a second stage if executed.[29]

DarkComet

DarkComet can execute various types of scripts on the victim’s machine.[30]

Darkhotel

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.[31]

DealersChoice

DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.[32]

Deep Panda

Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.[4]

Denis

Denis executes shellcode on the victim's machine.[13]

Dragonfly 2.0

Dragonfly 2.0 used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.[33][34]

Emotet

Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.[35][36][37][38]

Empire

Empire has modules for executing scripts.[39]

Exaramel

Exaramel has a command to execute VBS and GO scripts on the victim’s machine.[40]

FELIXROOT

FELIXROOT executes batch scripts on the victim’s machine.[41]

FIN10

FIN10 has executed malicious .bat files containing PowerShell commands.[42]

FIN4

FIN4 has used VBA macros to display a dialog box and collect victim credentials.[43][44]

FIN5

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.[45]

FIN6

FIN6 has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener. FIN6 has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.[46][47]

FIN7

FIN7 used VBS and JavaScript scripts to help perform tasks on the victim's machine.[48]

FIN8

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.[49]

Gallmaker

Gallmaker used PowerShell scripts for execution.[50]

Gamaredon Group

Gamaredon Group has used various batch scripts to establish C2, download additional files, and conduct other functions.[51]

Gorgon Group

Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.[52]

Helminth

One version of Helminth consists of VBScript and PowerShell scripts. The malware also uses batch scripting.[53]

Honeybee

Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.[54]

JHUHUGIT

JHUHUGIT uses a .bat file to execute a .dll.[8]

jRAT

jRAT has been distributed as HTA files with VBScript+JScript.[55]

Ke3chang

Ke3chang has used batch scripts in its malware to install persistence mechanisms.[56]

Keydnap

Keydnap uses Python for scripting to execute additional commands.[57]

Koadic

Koadic performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .[58]

Lazarus Group

A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.[59]

Leafminer

Leafminer infected victims using JavaScript code.[60]

Leviathan

Leviathan has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.[61]

Magic Hound

Magic Hound malware has used .vbs scripts for execution.[62]

menuPass

menuPass has used malicious macros embedded inside Office documents to execute files.[63][64]

MoonWind

MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.[65]

MuddyWater

MuddyWater has used VBScript and JavaScript files to execute its POWERSTATS payload. MuddyWater has also used Microsoft scriptlets, macros, and PowerShell scripts.[[66][67][68][69][70]

NanHaiShu

NanHaiShu executes additional Jscript and VBScript code on the victim's machine.[71]

NanoCore

NanoCore uses VBS and JavaScript files.[72]

NavRAT

NavRAT loads malicious shellcode and executes it in memory.[73]

OceanSalt

OceanSalt has been executed via malicious macros.[74]

OilRig

OilRig has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as QUADAGENT and OopsIE.[75][76][77][78][79]

OopsIE

OopsIE creates and uses a VBScript as part of its persistent execution.[77][80]

Orz

Orz can execute commands with script as well as execute JavaScript.[61]

OSX_OCEANLOTUS.D

OSX_OCEANLOTUS.D uses macros for execution as well as VBS and PowerShell scripts.[81]

Patchwork

Patchwork used Visual Basic Scripts (VBS), JavaScript code, batch files, and .SCT files on victim machines.[82][83]

POWERSTATS

POWERSTATS can use VBScript (VBE), PowerShell, and JavaScript code for execution.[70]

Proton

Proton uses macOS' .command file type to script actions.[84]

Proxysvc

Proxysvc uses a batch file to delete itself.[59]

Pupy

Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.[85]

QUADAGENT

QUADAGENT uses VBScripts and batch scripts.[78]

Rancor

Rancor has used shell and VBS scripts as well as embedded macros for execution.[86]

Remcos

Remcos uses Python scripts.[87]

Remexi

Remexi uses AutoIt and VBS scripts throughout its execution process.[88]

RogueRobin

To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1". RogueRobin also uses Windows Script Components.[89][90]

RunningRAT

RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.[91]

SamSam

SamSam uses custom batch scripts to execute some of its components.[92]

SeaDuke

SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.[9]

Smoke Loader

Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.[93]

SpeakUp

SpeakUp uses Perl and Python scripts.[94]

Stealth Falcon

Stealth Falcon malware uses PowerShell and WMI to script data collection and command execution on the victim.[95]

TA459

TA459 has a VBScript for execution.[96]

TrickBot

TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.[97]

TYPEFRAME

TYPEFRAME can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.[98]

Xbash

Xbash can execute malicious JavaScript and VBScript payloads on the victim’s machine.[99]

Zeus Panda

Zeus Panda can launch remote scripts on the victim’s machine.[100]

Mitigation

Turn off unused features or restrict access to scripting engines such as VBScript or scriptable administration frameworks such as PowerShell.

Configure Office security settings enable Protected View, to execute within a sandbox environment, and to block macros through Group Policy. [101] Other types of virtualization and application microsegmentation may also mitigate the impact of compromise. The risks of additional exploits and weaknesses in implementation may still exist. [102]

Detection

Scripting may be common on admin, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

Analyze Office file attachments for potentially malicious macros. Execution of macros may create suspicious process trees depending on what the macro is designed to do. Office processes, such as winword.exe, spawning instances of cmd.exe, script application like wscript.exe or powershell.exe, or other suspicious processes may indicate malicious activity. [103]

References

  1. Metasploit. (n.d.). Retrieved December 4, 2014.
  2. Veil Framework. (n.d.). Retrieved December 4, 2014.
  3. PowerSploit. (n.d.). Retrieved December 4, 2014.
  4. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  5. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  6. Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.
  7. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  8. Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.
  9. Symantec Security Response. (2015, July 13). “Forkmeiamfamous”: Seaduke, latest weapon in the Duke armory. Retrieved July 22, 2015.
  10. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  11. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  12. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
  13. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  14. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  15. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
  16. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019.
  17. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  18. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  19. Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.
  20. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  21. Positive Technologies. (2017, August 16). Cobalt Strikes Back: An Evolving Multinational Threat to Finance. Retrieved September 5, 2018.
  22. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  23. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018.
  24. Unit 42. (2018, October 25). New Techniques to Uncover and Attribute Financial actors Commodity Builders and Infrastructure Revealed. Retrieved December 11, 2018.
  25. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019.
  26. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  27. Thomas Reed. (2018, October 29). Mac cryptocurrency ticker app installs backdoors. Retrieved April 23, 2019.
  28. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  29. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.
  30. Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.
  31. Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.
  32. Falcone, R. (2018, March 15). Sofacy Uses DealersChoice to Target European Government Agency. Retrieved June 4, 2018.
  33. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  34. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  35. Symantec. (2018, July 18). The Evolution of Emotet: From Banking Trojan to Threat Distributor. Retrieved March 25, 2019.
  36. Brumaghin, E.. (2019, January 15). Emotet re-emerges after the holidays. Retrieved March 25, 2019.
  37. Trend Micro. (2019, January 16). Exploring Emotet's Activities . Retrieved March 25, 2019.
  38. Özarslan, S. (2018, December 21). The Christmas Card you never wanted - A new wave of Emotet is back to wreak havoc. Retrieved March 25, 2019.
  39. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  40. Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.
  41. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  42. FireEye iSIGHT Intelligence. (2017, June 16). FIN10: Anatomy of a Cyber Extortion Operation. Retrieved June 25, 2017.
  43. Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.
  44. Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.
  45. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  46. FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016.
  47. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
  48. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  49. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  50. Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.
  51. Kasza, A. and Reichel, D.. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  52. Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
  1. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  2. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  3. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  4. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  5. Patrick Wardle. (2017, January 1). Mac Malware of 2016. Retrieved September 21, 2018.
  6. Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
  7. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  8. Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
  9. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  10. Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.
  11. Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.
  12. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  13. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  14. Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.
  15. Villanueva, M., Co, M. (2018, June 14). Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor. Retrieved July 3, 2018.
  16. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
  17. Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
  18. ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
  19. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  20. Patel, K. (2018, March 02). The NanoCore RAT Has Resurfaced From the Sewers. Retrieved November 9, 2018.
  21. Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.
  22. Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.
  23. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  24. Falcone, R. and Lee, B. (2017, July 27). OilRig Uses ISMDoor Variant; Possibly Linked to Greenbug Threat Group. Retrieved January 8, 2018.
  25. Lee, B., Falcone, R. (2018, February 23). OopsIE! OilRig Uses ThreeDollars to Deliver New Trojan. Retrieved July 16, 2018.
  26. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  27. Falcone, R., Wilhoit, K.. (2018, November 16). Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery. Retrieved April 23, 2019.
  28. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  29. Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.
  30. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  31. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  32. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  33. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  34. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  35. Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.
  36. Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.
  37. Lee, B., Falcone, R. (2019, January 18). DarkHydrus delivers new Trojan that can use Google Drive for C2 communications. Retrieved April 17, 2019.
  38. Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
  39. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  40. Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.
  41. Hasherezade. (2016, September 12). Smoke Loader – downloader with a smokescreen still alive. Retrieved March 20, 2018.
  42. Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.
  43. Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.
  44. Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.
  45. Llimos, N., Pascual, C.. (2019, February 12). Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire. Retrieved March 12, 2019.
  46. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  47. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018.
  48. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  49. Windows Defender Research. (2016, March 22). New feature in Office 2016 can block macros and help prevent infection. Retrieved April 11, 2018.
  50. Goodin, D. (2017, March 17). Virtual machine escape fetches $105,000 at Pwn2Own hacking contest - updated. Retrieved March 12, 2018.
  51. Felix. (2016, September). Analyzing Malicious Office Documents. Retrieved April 11, 2018.