Loading story…
Malicious Microsoft Word documents masquerading as official Vietnamese correspondence were used in a suspected targeted campaign against victims in Vietnam, relying on template injection (T1221) to fetch remote content only when the file was opened. In one case, a .docx lure impersonating a dispatch from the Central Inspection Committee retrieved Main.jpg from 45[.]121[.]146[.]88; the file was actually a weaponized RTF that exploited an Equation Editor flaw, dropped an encoded payload 5.t into %Temp%, decoded it, and produced Download.dll, which was then executed through a scheduled task. Researchers said the lure appeared to have been created or modified with Kingsoft Office, while the DLL was built with Visual Studio 2019.
A similar sample analyzed later used a Word document to retrieve fav.ico from office[.]oiqezet[.]com, but that file also concealed an RTF with an embedded encrypted object that ultimately unpacked into another Download.dll. That malware collected host, operating system, user, internet, and antivirus information, encrypted the data with RC4 using the key 123abc, Base64-encoded it, and exfiltrated it to log.php on the same domain. The tradecraft matches MITRE ATT&CK's Template Injection technique, which allows attackers to hide payload delivery behind external template references and avoid obvious macro-based indicators, and one analysis noted code similarities to an earlier APT Panda campaign targeting Vietnam.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
A malicious Word document named "Bien ban thong nhat ke hoach dao tao_VPB.Voffice.docx" was submitted from Vietnam. Later analysis found it used template injection to retrieve an RTF disguised as fav.ico, decode an embedded object into Download.dll, and exfiltrate victim system information to log.php on the same domain.
VinCSS reported that the decrypted DLL payload, Download.dll, carried a PE TimeDateStamp of 2021-04-01 01:59:48 UTC. The researchers said the timestamp was consistent across the PE header and debug information.
A public analysis described a second malicious document highlighted by Shadow Chaser Group that used template injection and an RTF payload to deliver Download.dll. Reverse engineering showed the DLL collected host, OS, user, internet, and antivirus information, encrypted it with RC4 using the key "123abc," and Base64-encoded it before exfiltration.
VinCSS analyzed a lure document impersonating an official Central Inspection Committee dispatch and assessed it as likely part of a cyberattack campaign targeting Vietnam. The document used template injection to fetch a remote RTF disguised as Main.jpg, which exploited an Equation Editor flaw to drop and execute Download.dll via a scheduled task.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
kienmanowar.wordpress.com
Open sourceblog.vincss.net
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Researchers traced a **SideWinder** spearphishing campaign to a malicious Word document named **"Briefing on Ongoing Projects.docx"** that fetched a remote RTF template from a spoofed domain and exploited Microsoft Equation Editor via `CVE-2017-11882`. The recovered RTF decrypted embedded JavaScript, launched an obfuscated script, and executed a .NET component that profiled installed antivirus products before attempting to download a further payload stage. Investigators found the originally malicious RTF had later been replaced with a nearly empty placeholder file, a tactic that obscured follow-on analysis while preserving infrastructure clues. Additional infrastructure and tradecraft links tied the activity to broader South Asian espionage patterns involving malicious RTF lures, Equation Editor exploitation, and multi-stage loaders. Fortinet separately documented a spearphishing attack against a telecommunications agency in South Asia using an RTF lure that exploited `CVE-2018-0798`, abused **Logitech** DLL search order hijacking with a signed executable and malicious `LBTServ.dll`, injected into `svchost.exe`, and contacted `instructor[.]giize[.]com` to retrieve a payload linked through OSINT to **PoisonIvy RAT**. Across the references, the campaigns show consistent use of document-based initial access, obfuscated intermediate stages, and reusable infrastructure and tooling associated with long-running regional espionage operations.
Aug 15, 2026
Elastic analyzed a spearphishing operation targeting Malaysian government officials with a malicious Word document themed around Malaysia's 2020 political crisis. The document remotely loaded a VBA template that wrote DLL payloads to disk, downloaded Logitech's legitimate `LogiMailApp.exe`, and exploited DLL side-loading by placing a malicious `LogiMail.dll` beside it for execution. The backdoor retrieved and decrypted a second-stage implant in memory, enabling host reconnaissance, command execution, file transfers, Registry Run-key persistence, and AES-encrypted command-and-control through dynamic-DNS infrastructure. Elastic linked the activity with moderate confidence to the China-nexus APT40/Leviathan group, citing overlaps in strings, URLs, functionality, and tactics with indicators previously published by MyCERT; DLL side-loading is a widely used execution and defense-evasion technique tracked as MITRE ATT&CK `T1574.001`.
Sep 9, 2026