User Execution: Malicious Link

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.^[1]

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.^[2][3]

APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.^[4][5]

APT3 has lured victims into clicking malicious links delivered through spearphishing.^[6]

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.^[7][8][9]

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.^[10][11]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.^[12][13]

BackConfig has compromised victims via links to URLs hosting malicious content.^[14]

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.^[15][16][17]

BlackTech has used e-mails with malicious links to lure victims into installing malware.^[18]

Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.^[19][20]

During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.^[21]

During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.^[22]

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.^[23][24][25]

Confucius has lured victims into clicking on a malicious link sent through spearphishing.^[26]

Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.^[27]

Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.^[28]

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.^[29][30]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.^[31][32]

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.^[33]

EXOTIC LILY has used malicious links to lure users into executing malicious payloads.^[34]

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).^[35][36]

FIN7 has used malicious links to lure victims into downloading malware.^[37]

FIN8 has used emails with malicious links to lure victims into installing malware.^[38][39][40]

Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.^[41]

Gootloader has been executed through malicious links presented to users as internet search results.^[42][43]

Grandoreiro has used malicious links to gain execution on victim machines.^[44][45]

GuLoader has relied upon users clicking on links to malicious documents.^[46]

Hancitor has relied upon users clicking on a malicious link delivered through phishing.^[47]

Javali has achieved execution through victims clicking links to malicious websites.^[48]

Kerrdown has gained execution through victims opening malicious links.^[9]

Kimsuky has lured victims into clicking malicious links.^[49]

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.^[50]

Latrodectus has been executed through malicious links distributed in email campaigns.^[51][52]

LazyScripter has relied upon users clicking on links to malicious files.^[50]

Leviathan has sent spearphishing email links attempting to get a user to click.^[53][54]

LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.^[55]

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.^[56][57][58]

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.^[59][60]

Melcoz has gained execution through victims opening malicious links.^[48]

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.^[61]

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.^[62][63]

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.^[64][65][66]

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.^[67][68][69]

Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.^[70][71]

NETWIRE has been executed through convincing victims into clicking malicious links.^[72][46]

During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.^[73]

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.^[74][75]

OilRig has delivered malicious links to achieve execution on the target system.^[76][77][78]

During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.^[79][80]

During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.^[81]

During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.^[82]

OutSteel has relied on a user to click a malicious link within a spearphishing email.^[83]

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.^{[84][85][86][14]}

PLEAD has been executed via malicious links in e-mails.^[18]

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.^[87]

QakBot has gained execution through users opening malicious links.^{[88][89][90][91][92][93][94]}

RedCurl has used malicious links to infect the victim machines.^[95][96]

Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.^[83][97]

Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.^[83]

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.^[98]

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.^{[99][100][101][102]}

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.^[103]

Snip3 has been executed through luring victims into clicking malicious links.^[104]

SocGholish has lured victims into interacting with malicious links on compromised websites for execution.^[71]

SpicyOmelette has been executed through malicious links within spearphishing emails.^[25]

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.^[105]

TA2541 has used malicious links to cloud and web services to gain execution on victim machines.^[106][72]

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. ^{[107][108][109][110][111][112][113][114]}

TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.^[51]

TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.^[51]

Transparent Tribe has directed users to open URLs hosting malicious content.^[74][75]

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.^[115]

Turla has used spearphishing via a link to get users to download and run their malware.^[116]

Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.^[117]

Windshift has used links embedded in e-mails to lure victims into executing malicious code.^[118]

Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.^[119][120]

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.^[121]

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.^[122][123]

If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.

If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.