Phishing: Spearphishing Attachment

During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails. ^[2]

admin@338 has sent emails with malicious Microsoft Office documents attached.^[3]

The primary delivered mechanism for Agent Tesla is through email phishing messages.^[4]

Ajax Security Team has used personalized spearphishing attachments.^[5]

Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.^[6][7]

AppleSeed has been distributed to victims through malicious e-mail attachments.^[8]

APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.^[9]

APT1 has sent spearphishing emails containing malicious attachments.^[10]

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.^[11][12]

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.^[13]

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.^{[14][15][16][17][18][19][20][21]}

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.^{[22][23][24][25]}

APT30 has used spearphishing emails with malicious DOC attachments.^[26]

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.^{[27][28][29][30][31][32]}

APT33 has sent spearphishing e-mails with archive attachments.^[33]

APT37 delivers malware using spearphishing emails with malicious HWP attachments.^[34][35][36]

APT38 has conducted spearphishing campaigns using malicious email attachments.^[37]

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.^[38][39][40]

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.^[41]

Astaroth has been delivered via malicious e-mail attachments.^[42]

BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.^[43]

Bandook is delivered via a malicious Word document inside a zip file.^[44]

Bisonal has been delivered as malicious email attachments.^[45]

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.^[46][47]

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.^[48][49]

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.^[50]

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.^[51][52]

Bumblebee has gained execution through luring users into opening malicious attachments.^{[53][54][55][56]}

During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.^[57]

For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.^[58]

Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.^[59]

Clambling has been delivered to victim's machines through malicious e-mail attachments.^[60]

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.^{[61][62][63][64][65][66][67][68]}

Confucius has crafted and sent victims malicious attachments to gain initial access.^[69]

CURIUM has used phishing with malicious attachments for initial access to victim environments.^[70]

DanBot has been distributed within a malicious Excel attachment via spearphishing emails.^[71]

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.^[72]

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.^[73][74]

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.^[1][75][76]

DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.^[77]

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.^[78]

Dragonfly has sent emails with malicious attachments to gain initial access.^[79]

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.^[80][81]

Emotet has been delivered by phishing emails containing attachments. ^{[82][83][84][85][86][87][88][89][90]}

EnvyScout has been distributed via spearphishing as an email attachment.^[91]

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.^[92][53]

Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.^[93]

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.^[94][95]

FIN6 has targeted victims with e-mails containing malicious attachments.^[96]

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.^{[97][98][99][100][101]}

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.^{[102][103][104]}

Flagpro has been distributed via spearphishing as an email attachment.^[49]

During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.^[105]

Gallmaker sent emails with malicious Microsoft Office documents attached.^[106]

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.^{[107][108][109][110][111][112][113]}

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.^[114]

Hancitor has been delivered via phishing emails with malicious attachments.^[115]

Higaisa has sent spearphishing emails containing malicious attachments.^[116][117]

IcedID has been delivered via phishing e-mails with malicious attachments.^[118][119]

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.^{[120][121][122][123]}

IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.^[124][125]

Javali has been delivered as malicious e-mail attachments.^[42]

JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.^[100]

Kerrdown has been distributed through malicious e-mail attachments.^[32]

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.^{[126][127][128][129][130][8][131][132]}

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.^[133]

KONNI has been delivered via spearphishing campaigns through a malicious Word document.^[134]

KOPILUWAK has been delivered to victims as a malicious email attachment.^[135]

Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.^[136]

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.^{[137][138][139][140]}

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.^[133]

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.^[141][142]

Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.^[143]

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.^{[144][145][146]}

Malteiro has sent spearphishing emails containing malicious .zip files.^[147]

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.^{[148][149][150][151]}

Metamorfo has been delivered to victims via emails with malicious HTML attachments.^[152][153]

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.^[154]

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.^{[155][156][157]}

Moonstone Sleet delivered various payloads to victims as spearphishing attachments.^[158]

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.^{[159][160][161][162][163][164] [165][166]}

Mustang Panda has used spearphishing attachments to deliver initial access payloads.^{[167][168][169]}

Naikon has used malicious e-mail attachments to deliver malware.^[170]

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.^[171][172]

Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.^[173][174]

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.^[175]

Octopus has been delivered via spearsphishing emails.^[174]

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.^{[176][177][178]}

During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.^[179][180]

During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.^[181]

During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.^[182]

OutSteel has been distributed as a malicious attachment within a spearphishing email.^[183]

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.^{[184][185][186][187]}

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.^[188]

PoetRAT was distributed via malicious Word documents.^[189]

Pony has been delivered via spearphishing attachments.^[190]

QakBot has spread through emails with malicious attachments.^{[191][192][193][194][195][196][197][198][199]}

Ramsay has been distributed through spearphishing emails with malicious attachments.^[200]

Rancor has attached a malicious document to an email to gain initial access.^[201]

RedCurl has used phishing emails with malicious files to gain initial access.^[202][203]

REvil has been distributed via malicious e-mail attachments including MS Word Documents.^{[204][205][206][207][208]}

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.^[209]

ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.^[210]

RTM has been delivered via spearphishing attachments disguised as PDF documents.^[211]

RTM has used spearphishing attachments to distribute its malware.^[212]

Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.^[183]

Saint Bot has been distributed as malicious attachments within spearphishing emails.^[213][183]

Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.^{[214][215][216][217][218][219]}

SideCopy has sent spearphishing emails with malicious hta file attachments.^[220]

Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.^[221]

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. ^{[222][223][224]}

Snip3 has been delivered to victims through malicious e-mail attachments.^[225]

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.^[226]

Star Blizzard has sent emails with malicious .pdf files to spread malware.^[227]

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.^[228]

TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.^[229][230]

TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.^[231]

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.^{[232][233][234][235][236][237][238][239][240]}

TA551 has sent spearphishing attachments with password protected ZIP files.^{[241][242][243]}

Taidoor has been delivered through spearphishing emails.^[244]

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.^[245]

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.^[60]

ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.^[138]

Tonto Team has delivered payloads via spearphishing attachments.^[246]

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.^{[247][248][249][250][251]}

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware^[252]

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.^{[253][254][255][256][257]}

Valak has been delivered via spearphishing e-mails with password protected ZIP files.^[241]

WarzoneRAT has been distributed as a malicious attachment within an email.^[258][69]

Water Curupira Pikabot Distribution attached password-protected ZIP archives to deliver Pikabot installers.^[259]

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.^[260]

Winter Vivern leverages malicious attachments delivered via email for initial access activity.^{[261][262][263]}

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.^[264]

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.^{[265][266][267]}

Woody RAT has been delivered via malicious Word documents and archive files.^[268]

ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.^[46]

Anti-virus can also automatically quarantine suspicious files.

Enable auditing and monitoring for email attachments and file transfers to detect and investigate suspicious activity. Regularly review logs for anomalies related to attachments containing potentially malicious content, as well as any attempts to execute or interact with these files. This practice helps identify spearphishing attempts before they can lead to further compromise.

Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.

Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.^[269][270]

Apply user account management principles to limit permissions for accounts interacting with email attachments, ensuring that only necessary accounts have the ability to open or execute files. Restricting account privileges reduces the potential impact of malicious attachments by preventing unauthorized execution or spread of malware within the environment.

Users can be trained to identify social engineering techniques and spearphishing emails.