value:  Bazar has been spread via e-mails with embedded malicious links. ;; BlackTech has used spearphishing e-mails with links to cloud services to deliver malware. ;; Cobalt Group has sent emails with URLs pointing to malicious documents. ;; Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites. ;; Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server. ;; Emotet has been delivered by phishing emails containing links. ;; Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive. ;; FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links. ;; FIN8 has distributed targeted emails containing links to malicious documents with embedded macros. ;; Grandoreiro has been spread via malicious links embedded in e-mails. ;; GuLoader has been spread in phishing campaigns using malicious web links. ;; Hancitor has been delivered via phishing emails which contained malicious links. ;; Javali has been delivered via malicious links embedded in e-mails. ;; Kerrdown has been distributed via e-mails containing a malicious link. ;; Kimsuky has used an email containing a link to a document that contained malicious macros. ;; Leviathan has sent spearphishing emails with links often using a fraudulent lookalike domain and stolen branding. ;; Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives. ;; Magic Hound sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy. ;; Melcoz has been spread through malicious links embedded in e-mails. ;; Mofang delivered spearphishing emails with malicious links included. ;; Molerats has sent phishing emails with malicious links included. ;; MuddyWater has sent targeted spearphishing e-mails with malicious links. ;; Mustang Panda has delivered spearphishing links to their target. ;; NETWIRE has been spread via e-mail campaigns utilizing malicious links. ;; Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded. ;; OilRig has sent spearphising emails with malicious links to potential victims. ;; Patchwork has used spearphishing with links to deliver files with exploits to initial victims. The group has also used embedded image tags (known as web bugs) with unique per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages. ;; Pony has been delivered via spearphishing emails which contained malicious links. ;; Sandworm Team has crafted phishing emails containing malicious hyperlinks. ;; Sidewinder has sent e-mails with malicious links often crafted for specific targets. ;; Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor. ;; TA505 has sent spearphishing emails containing malicious links. ;; TrickBot has been delivered via malicious links in phishing e-mails. ;; Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access. ;; Valak has been delivered via malicious links in e-mail. ;; Windshift has sent spearphishing emails with links to harvest credentials and deliver malware. ;; Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services. ;; ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.
name: Phishing: Spearphishing Link