Technique:  Phishing:Spearphishing Attachment
During the 2015 Ukraine Electric Power Attack, It obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.
It has sent emails with malicious Microsoft Office documents attached.
The primary delivered mechanism for Agent Tesla is through email phishing messages.
It has used personalized spearphishing attachments.
It has conducted spearphishing campaigns that included malicious Word or Excel attachments.
AppleSeed has been distributed to victims through malicious e-mail attachments.
It has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.
It has sent spearphishing emails containing malicious attachments.
It has sent emails with malicious Microsoft Office documents and PDFs attached.
It sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
It sent spearphishing emails containing malicious Microsoft Office and RAR attachments.
It has used spearphishing emails with an attachment to deliver files with exploits to initial victims.
It has used spearphishing emails with malicious DOC attachments.
It has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.
It has sent spearphishing e-mails with archive attachments.
It delivers malware using spearphishing emails with malicious HWP attachments.
It has conducted spearphishing campaigns using malicious email attachments.
It leveraged spearphishing emails with malicious attachments to initially compromise victims.
It sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.
Astaroth has been delivered via malicious e-mail attachments.
BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.
Bandook is delivered via a malicious Word document inside a zip file.
Bisonal has been delivered as malicious email attachments.
It has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.
It has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.
BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.
It used spearphishing emails with malicious Microsoft Word attachments to infect victims.
Bumblebee has gained execution through luring users into opening malicious attachments.
During C0011, It sent malicious attachments via email to student targets in India.
For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.
Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.
Clambling has been delivered to victim's machines through malicious e-mail attachments.
It has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.
It has crafted and sent victims malicious attachments to gain initial access.
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.
It has sent spearphishing emails with malicious RAR and .LNK attachments.
It has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.
DarkTortilla has been distributed via spearphishing emails containing archive attachments, with file types such as .iso, .zip, .img, .dmg, and .tar, as well as through malicious documents.
DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.
It has sent emails with malicious attachments to gain initial access.
It has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.
It has sent spearphishing emails containing malicious attachments in the form of PDFs, Word documents, JavaScript files, and Control Panel File (CPL) executables.
Emotet has been delivered by phishing emails containing attachments.
EnvyScout has been distributed via spearphishing as an email attachment.
It conducted an e-mail thread-hijacking campaign with malicious ISO attachments.
It has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.
It has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.
It has targeted victims with e-mails containing malicious attachments.
It sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.
It has distributed targeted emails containing Word documents with embedded malicious macros.
Flagpro has been distributed via spearphishing as an email attachment.
During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.
It sent emails with malicious Microsoft Office documents attached.
It has delivered spearphishing emails with malicious attachments to targets.
It sent emails to victims with malicious Microsoft Office documents attached.
Hancitor has been delivered via phishing emails with malicious attachments.
It has sent spearphishing emails containing malicious attachments.
IcedID has been delivered via phishing e-mails with malicious attachments.
It has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
It sent spearphishing emails containing malicious password-protected RAR attachments.
Javali has been delivered as malicious e-mail attachments.
JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.
Kerrdown has been distributed through malicious e-mail attachments.
It has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.
KOCTOPUS has been distributed via spearphishing emails with malicious attachments.
KONNI has been delivered via spearphishing campaigns through a malicious Word document.
KOPILUWAK has been delivered to victims as a malicious email attachment.
It has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
It has used spam emails weaponized with archive or document files as its initial infection vector.
It has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.
It has delivered spearphishing emails that contain a zipped file with malicious contents.
It has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.
Metamorfo has been delivered to victims via emails with malicious HTML attachments.
It delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.
It has sent phishing emails with malicious Microsoft Word and PDF attachments.
It has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.
It has used spearphishing attachments to deliver initial access payloads.
It has used malicious e-mail attachments to deliver malware.
NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.
It has targeted victims with spearphishing emails containing malicious attachments.
OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.
Octopus has been delivered via spearsphishing emails.
It has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.
During Operation Dream Job, It sent emails with malicious attachments to gain unauthorized access to targets' computers.
During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.
During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.
OutSteel has been distributed as a malicious attachment within a spearphishing email.
It has used spearphishing with an attachment to deliver files with exploits to initial victims.
It has sent spearphishing emails with attachments to victims as its primary initial access vector.
PoetRAT was distributed via malicious Word documents.
Pony has been delivered via spearphishing attachments.
QakBot has spread through emails with malicious attachments.
Ramsay has been distributed through spearphishing emails with malicious attachments.
It has attached a malicious document to an email to gain initial access.
REvil has been distributed via malicious e-mail attachments including MS Word Documents.
Rifdoor has been distributed in e-mails with malicious Excel or Word documents.
ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.
It has been delivered via spearphishing attachments disguised as PDF documents.
It has used spearphishing attachments to distribute its malware.
Saint Bot has been distributed as malicious attachments within spearphishing emails.
It has delivered malicious Microsoft Office attachments via spearphishing emails.
It has sent spearphishing emails with malicious hta file attachments.
It has sent e-mails with malicious attachments often crafted for specific targets.
It has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.
Snip3 has been delivered to victims through malicious e-mail attachments.
Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.
SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.
It has sent phishing emails with malicious attachments for initial access including MS Word documents.
It has targeted victims using spearphishing emails with malicious Microsoft Word attachments.
It has used spearphishing emails with malicious attachments to initially compromise victims.
It has sent spearphishing attachments with password protected ZIP files.
Taidoor has been delivered through spearphishing emails.
It has sent phishing emails with malicious Microsoft Word attachments to victims.
It has used e-mail to deliver malicious attachments to victims.
ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.
It has delivered payloads via spearphishing attachments.
It has sent spearphishing e-mails with attachments to deliver malicious payloads.
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware
It sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.
Valak has been delivered via spearphishing e-mails with password protected ZIP files.
WarzoneRAT has been distributed as a malicious attachment within an email.
It has sent spearphishing emails with attachment to harvest credentials and deliver malware.
It has sent emails to intended victims with malicious MS Word and Excel attachments.
It has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.
Woody RAT has been delivered via malicious Word documents and archive files.
ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.