Procedure examples

FIN7 used VBS scripts to help perform tasks on the victim's machine.

Sandworm Team has created VBScripts to run an SSH server.

Machete has embedded malicious macros within spearphishing attachments to download additional files.

Sidewinder has used VBScript to drop and execute malware loaders.

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.

APT39 has utilized malicious VBS scripts in malware.

Contagious Interview has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.

TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.

APT37 executes shellcode and a VBA script to decode Base64 strings.

OilRig has used VBScript macros for execution on compromised hosts.

Higaisa has used VBScript code on the victim's machine.

TA459 has a VBScript for execution.

Confucius has used VBScript to execute malicious code.

Leviathan has used VBScript.

Turla has used VBS scripts throughout its operations.

TA505 has used VBS for code execution.

RedCurl has used VBScript to run malicious files.

MirrorFace has used remote templates with VBA code in malware infection chains.

BRONZE BUTLER has used VBS and VBE scripts for execution.

LazyScripter has used VBScript to execute malicious code.

Windshift has used Visual Basic 6 (VB6) payloads.

Malteiro has utilized a dropper containing malicious VBS scripts.

APT42 has used a VBScript to query anti-virus products.

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Earth Lusca used VBA scripts.

FIN4 has used VBA macros to display a dialog box and collect victim credentials.

Silence has used VBS scripts.

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Molerats used various implants, including those built with VBScript, on target machines.

Transparent Tribe has crafted VBS-based malicious documents.

Inception has used VBScript to execute malicious commands and payloads.

HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.

Rancor has used VBS scripts as well as embedded macros for execution.

WIRTE has used VBScript in its operations.

Magic Hound malware has used VBS scripts for execution.

APT33 has used VBScript to initiate the delivery of payloads.

FIN13 has used VBS scripts for code execution on comrpomised machines.

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.

Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.

MuddyWater has developed tools in Python including Out1.

Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.

ZIRCONIUM has used Python-based implants to interact with compromised hosts.

Rocke has used Python-based malware to install and spread their coinminer.

APT39 has used a command line utility and a network scanner written in python.

UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.

Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.

APT37 has used Python scripts to execute payloads.

Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.

RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.