value:  Bazar can gain execution via malicious links to decoy landing pages hosted on Google Docs. ;; BlackTech has used e-mails with malicious links to lure victims into installing malware. ;; Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine. ;; Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links. ;; Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links. ;; Emotet has relied upon users clicking on a malicious link delivered through spearphishing. ;; Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file. ;; FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts). ;; FIN8 has leveraged Spearphishing Links attempting to gain User Execution. ;; Grandoreiro has used malicious links to gain execution on victim machines. ;; GuLoader has relied upon users clicking on links to malicious documents. ;; Hancitor has relied upon users clicking on a malicious link delivered through phishing. ;; Javali has achieved execution through victims clicking links to malicious websites. ;; Kerrdown has gained execution through victims opening malicious links. ;; Leviathan has sent spearphishing email links attempting to get a user to click. ;; Machete has has relied on users opening malicious links delivered through spearphishing to execute malware. ;; Melcoz has gained execution through victims opening malicious links. ;; Mofang's spearphishing emails required a user to click the link to connect to a compromised website. ;; Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable. ;; MuddyWater has distributed URLs in phishing e-mails that link to lure documents. ;; Mustang Panda has sent malicious links directing victims to a Google Drive folder. ;; NETWIRE has been executed through convincing victims into clicking malicious links. ;; Night Dragon enticed users to click on links in spearphishing emails to download malware. ;; OilRig has delivered malicious links to achieve execution on the target system. ;; Patchwork has used spearphishing with links to try to get users to click download and open malicious files. ;; PLEAD has been executed via malicious links in e-mails. ;; Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks. ;; Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders. ;; Sidewinder has lured targets to click on malicious links to gain execution in the target environment. ;; TA505 has used lures to get users to click links in emails and attachments. For example TA505 makes their malware look like legitimate Microsoft Word documents .pdf and/or .lnk files. ;; TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education Culture Sports Science and Technology of Japan. ;; Turla has used spearphishing via a link to get users to download and run their malware. ;; Windshift has used links embedded in e-mails to lure victims into executing malicious code. ;; Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing. ;; ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.
name: User Execution: Malicious Link