The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented. QUADAGENT is the 12th custom built tool that Unit 42 has documented the OilRig group using for their attacks. In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The use of malicious macro delivery documents is a tactic we have observed the OilRig group use repeatedly over the three years we’ve been tracking them. The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2. We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack. While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document