Loading story…
Proofpoint reported that operators behind the Dyre banking malware changed their distribution strategy by using the Gophe spambot to send tens of thousands of spam emails carrying randomized malicious Microsoft Word documents. The campaign relied on heavy attachment variation, rotating filenames, and multi-stage redirection to reduce the effectiveness of signature-based detection, antivirus tools, and behavioral defenses while increasing the scale and resilience of delivery.
The malicious Office macro chain wrote RTF files into the temporary directory and opened an RTF containing an embedded Upatre executable packaged as a Packager Shell Object. Proofpoint said the technique abused an RTF-specific Microsoft Office behavior that allowed the embedded executable to be dropped to %TMP% without user interaction, after which the dropped binary was executed to continue the infection chain and retrieve the Dyre payload. The report also identified infrastructure tied to the activity, including Gophe command-and-control servers, an Upatre C2 address, and multiple Dyre payload URLs.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
On October 8, Proofpoint observed the Gophe botnet distributing tens of thousands of unique malicious Word documents in a Dyre malware campaign. The campaign used randomized filenames and many unique attachment hashes to hinder signature-based detection.
Proofpoint identified Gophe command-and-control servers at 62.210.182.246 and 178.162.193.207, an Upatre C2 at 197.149.90.166, and numerous Dyre payload URLs ending in /limto1.tar associated with the campaign. This disclosure provided technical indicators tied to the observed operation.
Proofpoint reported that the campaign's malicious Office document used a macro to write RTF files to %TMP%, open an RTF containing an embedded Upatre executable, and later execute the dropped binary. The researchers assessed this multi-stage chain as an evasion technique that leveraged RTF-specific Microsoft Office behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 104 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large email campaign used malicious Microsoft Word RTF attachments to exploit **CVE-2017-0199** and install the **Dridex** banking trojan on vulnerable systems. Researchers said the operation targeted millions of recipients across numerous organizations, primarily in Australia, using lures such as "Scan Data" and spoofed sender formats to make booby-trapped documents appear legitimate. Proofpoint identified the activity as a notable shift for Dridex operators, who had more commonly relied on macro-enabled documents, while McAfee, FireEye, and Ars Technica reported that the exploit worked broadly across Windows versions of Word and could bypass common exploit mitigations. The attack was especially dangerous because it did not require macros and could execute even when Word presented warning dialogs; in many Protected View cases, users only needed to click **Enable Editing** for the infection chain to proceed. Successful exploitation reportedly installed **Dridex botnet ID 7500**, and Microsoft issued a patch for the flaw on April 11 after researchers warned that the zero-day had already been rapidly weaponized in the wild. Separately, Microsoft has also disclosed **CVE-2026-35440**, an **Important** Microsoft Word information disclosure flaw that requires user interaction and is assessed as less likely to be exploited, but it was not reported as publicly exploited.
Jun 29, 2026
Attackers used **CVE-2017-0199** in malicious Microsoft Word and RTF documents to trigger the `hta` handler and pull follow-on payloads from attacker-controlled infrastructure, enabling code execution without relying on macros. One observed chain used a fake invoice attachment disguised as a `.doc` file to fetch a malicious HTA, then downloaded a Remcos RAT installer and an AutoIt-based persistence component over HTTPS from `streetsave[.]club` and `regwide[.]club`; the infected host later communicated with `darlz.freeddns[.]org` on port `1695`. Separate in-the-wild activity documented the same exploit delivering Visual Basic script stages that killed `winword.exe`, retrieved a payload disguised as an image, copied it as a Startup-folder `winword.exe`, and opened a decoy document to hide the intrusion. Researchers linked final payloads to **WingBird** and **FinFisher-like** malware, while other malicious documents delivered **LATENTBOT**; the campaigns relied on obfuscation, anti-analysis techniques, and persistence through registry Run keys or Startup-folder placement, underscoring the need to patch vulnerable Office systems.
Aug 15, 2026
Researchers reported that **Rietspoof** operated as a low-prevalence, rapidly evolving multi-stage malware family that began with social-engineering lures delivered through malicious Microsoft Word documents and possibly email or messaging platforms such as Outlook and Skype. The infection chain used an obfuscated **VBS** script, an embedded **CAB** archive, signed executables, and later redesigned downloader components, with several stages capable of deleting artifacts, changing the system date, and removing themselves to hinder analysis. Multiple samples carried valid digital signatures, and newer variants added persistence through scheduled tasks, a `WindowsUpdate.lnk` startup shortcut, and optional service installation. The malware's command-and-control design changed quickly as operators increased their update cadence from roughly monthly to daily, shifting from raw TCP with negotiated **AES-CBC** encryption to variants that also used **HTTP/HTTPS** with hard-coded key material. Its bot stages supported file upload and download, process execution, self-destruction, and payload retrieval, while later stages used **NTLM-authenticated TCP** channels and, in some cases, fileless execution through `cmd` and pipes to launch additional malware. Researchers said the infrastructure appeared to geofence responses toward U.S.-based IP addresses, but Rietspoof's final payloads, targeting, and operator objectives remained unclear.
Aug 15, 2026