Phishing: Spearphishing Link

AppleJeus has been distributed via spearphishing link.^[2]

APT1 has sent spearphishing emails containing hyperlinks to malicious files.^[3]

APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.^[4][5][6]

APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.^[7]

APT32 has sent spearphishing emails containing malicious links.^{[8][9][10][11][12]}

APT33 has sent spearphishing emails containing links to .hta files.^[13][14]

APT39 leveraged spearphishing emails with malicious links to initially compromise victims. ^[15][16]

Bazar has been spread via e-mails with embedded malicious links.^[17][18]

BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.^[19]

Cobalt Group has sent emails with URLs pointing to malicious documents.^[20]

Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.^[21]

Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.^[22][23]

Emotet has been delivered by phishing emails containing links. ^{[24][25][26][27][28][29][30][30][31]}

Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.^[32]

FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.^[33][34]

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.^[35]

Grandoreiro has been spread via malicious links embedded in e-mails.^[36][37]

GuLoader has been spread in phishing campaigns using malicious web links.^[38]

Hancitor has been delivered via phishing emails which contained malicious links.^[39]

Javali has been delivered via malicious links embedded in e-mails.^[40]

Kerrdown has been distributed via e-mails containing a malicious link.^[12]

Kimsuky has used an email containing a link to a document that contained malicious macros.^[41]

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.^[42]

Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.^[43][44]

Magic Hound sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy.^[45]

Melcoz has been spread through malicious links embedded in e-mails.^[40]

Mofang delivered spearphishing emails with malicious links included.^[46]

Molerats has sent phishing emails with malicious links included.^[47]

MuddyWater has sent targeted spearphishing e-mails with malicious links.^[48][49]

Mustang Panda has delivered spearphishing links to their target.^[50]

NETWIRE has been spread via e-mail campaigns utilizing malicious links.^[38]

Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded.^[51]

OilRig has sent spearphising emails with malicious links to potential victims.^[52]

Patchwork has used spearphishing with links to deliver files with exploits to initial victims. The group has also used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.^{[53][54][55][56]}

Pony has been delivered via spearphishing emails which contained malicious links.^[57]

Sandworm Team has crafted phishing emails containing malicious hyperlinks.^[58]

Sidewinder has sent e-mails with malicious links often crafted for specific targets.^[59][60]

Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor.^[61]

TA505 has sent spearphishing emails containing malicious links.^{[62][63][64][65]}

TrickBot has been delivered via malicious links in phishing e-mails.^[66]

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.^[67]

Valak has been delivered via malicious links in e-mail.^[68]

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.^[69]

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.^[70][71]

ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.^[72][73][74]

Determine if certain websites that can be used for spearphishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM). Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.^[75][76]

Users can be trained to identify social engineering techniques and spearphishing emails with malicious links.