An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0134 | Transparent Tribe | Pakistan |
| grp_g0103 | Mofang | — |
| grp_g0095 | Machete | — |
| grp_g1011 | EXOTIC LILY | — |
| grp_g1018 | TA2541 | — |
| grp_g1034 | Daggerfly | — |
| grp_g1037 | TA577 | — |
| grp_g0021 | Molerats | — |
| grp_g1038 | TA578 | — |
| grp_g0085 | FIN4 | — |
| grp_g0120 | Evilnum | — |
| grp_g0090 | WIRTE | — |
| grp_g1014 | LuminousMoth | China |
| grp_g1020 | Mustard Tempest | — |
| grp_g1031 | Saint Bear | Russia |
| grp_g0128 | ZIRCONIUM | — |
| grp_g1035 | Winter Vivern | — |
| grp_g0129 | Mustang Panda | China |
| grp_g0064 | APT33 | Iran |
| grp_g0142 | Confucius | — |
| grp_g0112 | Windshift | — |
| grp_g0066 | Elderwood | China |
| grp_g0080 | Cobalt Group | — |
| grp_g1039 | RedCurl | Russia |
| grp_g0102 | Wizard Spider | Russia |
| grp_g0049 | OilRig | Iran |
| grp_g1052 | Contagious Interview | — |
| grp_g0069 | MuddyWater | — |
| grp_g0061 | FIN8 | — |
| grp_g0082 | APT38 | DPRK |
| grp_g1059 | NIMBUS MANTICORE | — |
| grp_g0065 | Leviathan | China |
| grp_g0046 | FIN7 | — |
| grp_g0087 | APT39 | — |
| grp_g0010 | Turla | Russia |
| grp_g0099 | APT-C-36 | — |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0022 | APT3 | China |
| grp_g0092 | TA505 | — |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0059 | Magic Hound | Iran |
| grp_g0098 | BlackTech | China |
| grp_g0140 | LazyScripter | — |
| grp_g1006 | Earth Lusca | China |
| grp_g0007 | APT28 | Russia |
| grp_g0016 | APT29 | Russia |
| grp_g0040 | Patchwork | — |
| grp_g0121 | Sidewinder | India |
| grp_g0034 | Sandworm Team | Russia |
| grp_g0050 | APT32 | Vietnam |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.