The first spam run on August 31 used a Rich Text Format (RTF) document laden with malicious macros. The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled. We also saw other threat actors using the same security flaw of late, like the cyberespionage group ChessMaster