TA505 has been using Excel file, Word document, or .WIZ files as its attack entry point. However, as mentioned earlier, the group has also started to attach an HTML link in emails to trick users into opening the Excel file