Loading story…
Threat actors are increasingly leveraging weaponized document formats and add-ins to compromise Windows users, with recent campaigns targeting organizations in multiple countries. One operation uncovered by researchers used phishing emails with RAR archives containing obfuscated JavaScript payloads, which exploited the CVE-2017-11882 vulnerability in Microsoft Office's Equation Editor. The infection chain included the use of malicious SVG files, ZIP archives with LNK shortcuts, and a sophisticated four-stage execution pipeline involving steganographically embedded .NET assemblies and the abuse of legitimate open-source libraries, all designed to evade detection and deliver commodity loaders for Remote Access Trojans and information stealers.
Separately, attackers have been abusing Microsoft Excel's XLL add-in format to deliver malware, with a notable increase in such activity since 2021. Recent incidents include the submission of malicious XLL files to VirusTotal from Ukraine and Russia, which contained a backdoor named EchoGather capable of system reconnaissance, command execution, and file transfer. These XLL-based attacks often use open-source frameworks like Excel-DNA to facilitate payload delivery and in-memory execution, further complicating detection and mitigation efforts for targeted organizations.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Based on standardized methods and class naming conventions, researchers concluded that the loader framework used in the email campaign appears to be shared among multiple threat actors rather than tied to a single group.
The campaign used a four-stage execution chain with obfuscation, steganography, process injection, and a novel UAC bypass to deploy malware including PureLog Stealer, Katz Stealer, DC Rat, Async Rat, and Remcos.
Researchers reported a separate email-based malware campaign targeting manufacturing and government organizations in Italy, Finland, and Saudi Arabia using weaponized Office documents, malicious SVG files, and ZIP archives containing LNK shortcuts.
The Intezer report also tied ruzede[.]com to a WinRAR path traversal and alternate data stream exploitation chain using CVE-2025-8088 to deliver a PowerShell downloader, aligning with previously observed Paper Werewolf tradecraft.
Infrastructure analysis connected the Paper Werewolf activity to the domains fast-eda[.]my and ruzede[.]com, as well as PowerShell-based loaders that displayed Russian-language decoy PDFs while running the backdoor.
The malicious XLL loader was designed to trigger from DllMain during DLL_THREAD_DETACH rather than standard XLL exports, then drop and execute a second-stage backdoor dubbed EchoGather, likely to evade sandbox and behavior-based detection.
In late October 2025, a campaign attributed to Paper Werewolf (also known as GOFFEE) used a malicious 64-bit Excel XLL loader to infect targets, primarily Russian organizations.
According to the report, use of Excel XLL add-ins expanded beyond advanced threat groups and became more common in commodity malware campaigns starting in 2021.
The Intezer report notes that APT10 had been abusing Excel XLL add-ins to execute arbitrary code since at least 2017, establishing an early precedent for this technique in targeted intrusions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 28 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that attackers increasingly used malicious Microsoft Excel add-in files with the `.xll` extension as an initial access vector, exploiting Excel's `xlAutoOpen` behavior to run code with a single user action. HP Wolf Security said the technique was being used to deliver malware including **Dridex**, **Agent Tesla**, **Raccoon Stealer**, and **Formbook**, and noted that some samples were built with the legitimate **Excel-DNA** framework while others were custom downloaders that decrypted embedded configuration data, resolved APIs dynamically, fetched payloads, and executed them. Researchers also observed underground promotion of XLL dropper builders, indicating the method was becoming commoditized. Fortinet and SANS documented active spam operations using the format in the wild. One campaign used DHL and Amazon-themed lures to distribute a signed malicious XLL that downloaded `csrsc.exe` from `dmequest[.]com`, saved it as `%PUBLIC%\srtherhaeth[.]eXe`, and installed a Rust-based **Buer Loader** variant that communicated with `shipmentofficedepot[.]com`; the file was signed with a certificate assigned to **HORUM**, likely to reduce detection. Separately, SANS observed a **Hancitor** malspam wave using DocuSign-themed emails and Google `feedproxy` links that redirected victims through compromised sites to an XLL payload, which then retrieved an HTA file and a Hancitor executable from `srand04rf[.]ru`, followed by activity linked to **Cobalt Strike** and **Ficker Stealer**. Defenders were advised to block inbound XLL attachments, restrict add-ins to trusted signed files, or disable proprietary Excel add-ins where possible.
Aug 15, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026