# A Taxonomy for Threat Actors' Delivery Techniques
## 4 Techniques and Limitations
As this approach is focused on modeling whole malicious campaigns, the delivery tactic is linked to other stages inside an operation, which is an approach inappropriate for our particular focus on the analysis of the delivery tactic. Being a malware with high impact campaigns during the last few years, ransomware delivery has been specifically analyzed in different works. In [35], [PERSON] et al. propose an analysis and detection approach of ransomware based on its delivery mechanisms. The authors provide a feature selection and extraction from different ransomware families, but they do not identify any classification for the delivery techniques used in each case, focusing only on URL and indicators of compromise linked to ransomware. In [36], [PERSON] et al. focus on the detection of ransomware delivered through a specific technique, namely, exploit kits. In [26], [PERSON] et al. discuss the delivery of ransomware by techniques linked to social engineering, malvertisement, and traffic distribution systems, providing an analysis for each of them. None of these works tries to establish a complete taxonomy for ransomware delivery techniques. General delivery techniques have been analyzed in-depth, taking into account both their description and their countermeasures. General social engineering attacks, on which many delivery techniques are based, are modeled with graphs in [37]. Phishing is modeled in works such as [38; 39; 40] or [41]. Watering hole techniques are described in [42; 43]. Even less common delivery techniques, such as baiting [44; 45] or supply chain compromise [46; 47; 48] have been deeply analysed. Please note that although not widely used until now, supply chain compromise is an increasing trend for threat actors, as we will detail later in this paper. As stated before, social engineering is the base of many delivery techniques; apart from its modeling, different taxonomies have been developed for social engineering attacks. In [49], [PERSON] et al. divide social engineering techniques into two main categories: person to person and person to person via media. In [50], [PERSON] et al. establish three parameters for a taxonomy definition: type, operator, and channel, while [51] presents a kill chain to classify social engineering attacks, with three mandatory steps: orchestration, exploitation, and execution. In [52], [PERSON] et al. differentiate two parameters to establish an accurate taxonomy: who or what attacks are based on (human or technology) and how they are executed (physical, technical, social, and socio-technical). In this work, the authors also provide accurate examples of particular techniques for many social engineering attacks. These works present different taxonomies for social engineering attacks; in [53] we can find a summary of them, and a survey is presented in [54], where [PERSON] et al. provide accurate classification schemes for this technique. However, not all delivery techniques include social engineering; therefore, we must generalize our taxonomy in order to provide a global valid approach for the delivery tactic. As phishing is one of the most widely used techniques for the delivery tactic, it has been largely analyzed and its particular implementations have been classified. In [55], [PERSON] et al. identify four phishing techniques: spear phishing, clone phishing, malware-based phishing, and search engine phishing. This approach is purely focused on specific technical aspects in order to identify phishing countermeasures; therefore, it is not suitable to establish a taxonomy, even an initial one. In [56], [PERSON] et al. define a taxonomy for e-mail based phishing attacks, based on different features of the malicious e-mail used in an operation. The authors highlight the lack of e-mail-based phishing attacks' taxonomy and propose a novel one, but only with a focus on this particular technique; thus, it can not be considered a general purpose approach that is valid for all delivery techniques. In [57], [PERSON] et al.