Phishing: Spearphishing Attachment

admin@338 has sent emails with malicious Microsoft Office documents attached.^[1]

The primary delivered mechaism for Agent Tesla is through email phishing messages.^[2]

Ajax Security Team has used personalized spearphishing attachments.^[3]

APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.^[4]

APT1 has sent spearphishing emails containing malicious attachments.^[5]

APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.^[6][7]

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.^[8]

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.^{[9][10][11][12][13][14][15]}

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.^[16][17][18]

APT30 has used spearphishing emails with malicious DOC attachments.^[19]

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.^{[20][21][22][23][24][25]}

APT33 has sent spearphishing e-mails with archive attachments.^[26]

APT37 delivers malware using spearphishing emails with malicious HWP attachments.^[27][28][29]

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims. ^[30][31][32]

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.^[33]

BlackTech has used spearphishing e-mails with malicious documents to deliver malware.^[34]

BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.^[35]

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.^[36][37]

Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.^{[38][39][40][41][42][43][44][45]}

Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.^[46][47]

DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.^[48][49][50]

Dragonfly 2.0 used spearphishing with Microsoft Office attachments to target victims.^[51][52]

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.^[53][54]

Emotet has been delivered by phishing emails containing attachments. ^{[55][56][57][58][59][60][61][62][63]}

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.^[64][65]

FIN6 has targeted victims with e-mails containing malicious attachments.^[66]

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.^[67][68][69]

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.^[70][71][72]

Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.^[73]

Gallmaker sent emails with malicious Microsoft Office documents attached.^[74]

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.^[75][76]

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.^[77]

Hancitor has been delivered via phishing emails with malicious attachments.^[78]

Higaisa has sent spearphishing emails containing malicious attachments.^[79][80]

IcedID has been delivered via phishing e-mails with malicious attachments.^[81]

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.^{[82][83][84][85]}

Javali has been delivered as malicious e-mail attachments.^[86]

Kerrdown has been distributed through malicious e-mail attachments.^[25]

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.^{[87][88][89][90][91]}

Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.^[92]

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.^[93]

Machete has delivered spearphishing emails that contain a zipped file with malicious contents.^[94][95][96]

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.^{[97][98][99][100]}

Metamorfo has been delivered to victims via emails containing malicious HTML attachments.^[101]

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.^[102]

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.^{[103][104][105]}

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.^{[106][107][108][109][110][111]}

Mustang Panda has used spearphishing attachments to deliver initial access payloads.^[112][113]

Naikon has used malicious e-mail attachments to deliver malware.^[114]

NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.^[115][116]

OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.^[117]

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.^{[118][119][120]}

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.^{[121][122][123][124]}

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.^[125]

PoetRAT was distributed via malicious Word documents.^[126]

Pony has been delivered via spearphishing attachments.^[127]

Ramsay has been distributed through spearphishing emails with malicious attachments.^[128]

Rancor has attached a malicious document to an email to gain initial access.^[129]

REvil has been distributed via malicious e-mail attachments including MS Word Documents.^{[130][131][132][133][134]}

Rifdoor has been distributed in e-mails with malicious Excel or Word documents.^[135]

RTM has been delivered via spearphishing attachments disguised as PDF documents.^[136]

RTM has used spearphishing attachments to distribute its malware.^[137]

Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.^{[138][139][140][141]}

Sharpshooter has sent malicious attachments via emails to targets.^[142]

Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.^[143]

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. ^{[144][145][146]}

TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.^[147]

TA505 has used spearphishing emails with malicious attachments to initially compromise victims.^{[148][149][150][151][152][153][154][155][156]}

TA551 has sent spearphishing attachments with password protected ZIP files.^{[157][158][159]}

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.^[160]

TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware^[161]

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.^{[162][163][164][165][166]}

Valak has been delivered via spearphishing e-mails with password protected ZIP files.^[157]

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.^[167]

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.^[168][169]

Anti-virus can also automatically quarantine suspicious files.

Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.

Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.^[170][171]

Users can be trained to identify social engineering techniques and spearphishing emails.