System Binary Proxy Execution and a Spearphish Payload

Spearphishing is one of the oldest tricks in the book, and in this course you will learn more about how it actually works. Plus, see how adversaries can hide malicious code in compiled HTML files. Detect and mitigate these techniques in our hands-on course.

Course Content

Campaign Overview


APT41 Introduction
Detection, Validation, and Mitigation (Lab)


System Binary Proxy Execution and a Spearphish Payload
What is the “Phishing: Spearphishing Attachment” Sub-Technique?


System Binary Proxy Execution and a Spearphish Payload
Course Description

Adversaries can execute an attack by embedding malware into a document, attaching that document to an email, crafting the email message to entice the target, and then sending the email to the target.

The first technique we cover, Spearphishing Attachment, is generally one of the first steps in an attack process. By this point, the adversary has already performed some reconnaissance and resource development.

The primary risk associated with the second technique we cover, Compiled HTML File, is the execution of unauthorized/malicious code without detection, and any subsequent impacts. For the purpose of this course, it will be observed as a file contained in an email attachment associated with a Spearphishing Attachment as part of an Initial Access attempt.

Learn how to detect and mitigate these techniques to protect your organization from this type of attack.

Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT41 (aka Double Dragon). Prevent adversaries from accomplishing the tactic of initial access.

This course is part of a Career Path:
No items found.

Instructed by

Master Instructor
Matthew Mullins

Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.

Chris Daywalt

After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.

Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:

  • 30% doing DFIR
  • 30% teaching DFIR
  • 20% monitoring and detection engineering
  • 15% risk assessment
  • 5% other stuff, like sneaking in a game of Plants vs. Zombies or taking a quick nap at the desk (Don’t judge - I work overtime)

    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a System Binary Proxy Execution and a Spearphish Payload Certificate of Completion