Loading story…
Netskope Threat Labs reported a campaign using malicious Web Page Archive files (.mht/.mhtml), often delivered inside RAR archives, to infect Microsoft Word users with a DLL backdoor. The attack abuses the Windows Zone.Identifier alternate data stream by setting ZoneId=2, causing the archive to appear trusted enough for Word to open with fewer warnings. Once opened, the lure document uses password-protected and obfuscated VBA macros to drop, repair, rename, and execute the payload while displaying a decoy document to the victim.
The final payload is a packed 64-bit DLL named background.dll that establishes persistence through a scheduled task called Winrar Update, injects into a long-running rundll32.exe process, and collects host and file-system information before encrypting and exfiltrating it to command-and-control infrastructure hosted on Glitch. Microsoft documentation identifies Zone.Identifier as the stream name used to store zone information in Windows, supporting the mechanism abused in the campaign. Netskope said the tradecraft overlaps with earlier activity linked to APT32/Ocean Lotus, including prior use of Web Archive delivery and a similar backdoor seen in 2021.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Netskope said the campaign shared similarities with prior activity linked to APT32/Ocean Lotus, including a similar backdoor observed in August 2021 and earlier use of Web Archive delivery.
Netskope Threat Labs reported a campaign using RAR-packaged .mht/.mhtml Web Page Archive files to deliver infected Microsoft Word documents that relied on trusted Zone.Identifier values and malicious VBA macros to install a DLL backdoor. Netskope also reported the Glitch-hosted command-and-control URLs to Glitch's abuse team, which removed them.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Microsoft documented **CVE-2021-40444** as a remote code execution flaw in the MSHTML engine that could be triggered through specially crafted Microsoft Office documents, and security reporting tied the issue to attachment-based phishing campaigns. MITRE ATT&CK maps this activity to **`T1566.001` Spearphishing Attachment**, a technique widely used by both state-backed and criminal actors to gain initial access through Word, Excel, RTF, PDF, archive, and shortcut files sent by email. Security telemetry and malware analysis showed how the technique translated into real-world intrusion activity. A suspicious Word document sample analyzed in ANY.RUN and Trustwave reporting on a trojanized OneNote lure illustrate the broader pattern of weaponized Office attachments being used to execute payloads such as **FormBook**. Splunk also published detection guidance for spotting Office processes loading **`mshtml.dll`**, noting that such module loads can indicate exploitation of **CVE-2021-40444** and may precede arbitrary code execution, data theft, or deeper compromise.
Aug 15, 2026
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026