The initial backdoor is deployed using a decoy document containing a macro. Here are some examples of the content delivered to the victims: The observed content has some common characteristics like the attempt to impersonate National entities; the four documents mimics