LazyScripter has lured users to open malicious email attachments.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

LazyScripter has used JavaScript in its attacks.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

LazyScripter has used several different security software icons to disguise executables.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

LazyScripter has leveraged dynamic DNS providers for C2 communications.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

LazyScripter has used

Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

LazyScripter has used

Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

LazyScripter has used GitHub to host its payloads to operate spam campaigns.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

LazyScripter has used VBScript to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

LazyScripter has used PowerShell scripts to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|