Tag: vba macro

2 Attack Reports | 0 Vulnerabilities

Attack reports

Analyzing NotDoor: Inside APT28's Expanding Arsenal

LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The …
backdoor
obfuscation
exfiltration
persistence
nato
dll side-loading
outlook
vba macro
2025-09-03
notdoor
Published: September 3, 2025
Downloadable IOCs: 2

CTI Analysis: Malicious Email Campaign

An Iran-nexus spear-phishing campaign masquerading as the Omani Ministry of Foreign Affairs targeted global governments in August 2025. Attributed to Iranian-aligned operators linked to the Homeland Justice group and MOIS, the campaign used compromised mailboxes to send emails with malicious Micros…
anti-analysis
reconnaissance
spear-phishing
2025-09-02
vba macro
diplomatic targets
iran-nexus
oman mfa
Published: September 2, 2025
Downloadable IOCs: 15
Click here to see more Attack Reports