In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. Attack Overview . The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails. Figure 2: Macro to display lure document . The initial Word documents were password protected, likely in an effort to bypass detection. Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3. Figure 3: Lure document . Figure 4 shows what happens when the malicious macro is executed. The macro decodes the dropped files using Windows certutil.exe with the following commands (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows): 3. The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5. The macro deletes the initially dropped .txt files using Windows esentutl.exe and changes the document text to an embedded message. However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10. To mitigate the threat, users are advised to disable Office macros in their settings and not to open documents from unknown sources