User Execution: Malicious Link

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.^[1]

APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.^[2]

APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.^[3][4][5]

APT3 has lured victims into clicking malicious links delivered through spearphishing.^[6]

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.^[7][8][9]

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.^[10][11]

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.^[12][13]

BackConfig has compromised victims via links to URLs hosting malicious content.^[14]

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.^[15][16][17]

BlackTech has used e-mails with malicious links to lure victims into installing malware.^[18]

Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.^[19][20][21]

Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links.^[22][23]

Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.^[24][25]

Emotet has relied upon users clicking on a malicious link delivered through spearphishing.^[26][27]

Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.^[28]

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).^[29][30]

FIN7 has used malicious links to lure victims into downloading malware.^[31]

FIN8 has used emails with malicious links to lure victims into installing malware.^[32][33][34]

Grandoreiro has used malicious links to gain execution on victim machines.^[35][36]

GuLoader has relied upon users clicking on links to malicious documents.^[37]

Hancitor has relied upon users clicking on a malicious link delivered through phishing.^[38]

Javali has achieved execution through victims clicking links to malicious websites.^[39]

Kerrdown has gained execution through victims opening malicious links.^[9]

Leviathan has sent spearphishing email links attempting to get a user to click.^[40][41]

Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.^[42][43][44]

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.^[45]

Melcoz has gained execution through victims opening malicious links.^[39]

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.^[46]

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.^[47][48]

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.^[49][50]

Mustang Panda has sent malicious links directing victims to a Google Drive folder.^[51][52]

NETWIRE has been executed through convincing victims into clicking malicious links.^[53][37]

Night Dragon enticed users to click on links in spearphishing emails to download malware.^[54]

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.^[55][56]

OilRig has delivered malicious links to achieve execution on the target system.^[57][58][59]

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.^{[60][61][62][14]}

PLEAD has been executed via malicious links in e-mails.^[18]

Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.^[63]

QakBot has gained execution through users opening malicious links.^{[64][65][66][67][68][69]}

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.^[70]

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.^{[71][72][73][74]}

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.^[75]

SpicyOmelette has been executed through malicious links within spearphishing emails.^[21]

TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. ^{[76][77][78][79][80][81][82][83]}

Transparent Tribe has directed users to open URLs hosting malicious content.^[55][56]

TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.^[84]

Turla has used spearphishing via a link to get users to download and run their malware.^[85]

Windshift has used links embedded in e-mails to lure victims into executing malicious code.^[86]

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.^[87]

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.^[88][89]

If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.

If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.

Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.