Leviathan: Espionage Actor Targets Defense & Government

Exploitation: Microsoft Excel and Word documents with macros (sometimes password-protected), very recent vulnerabilities such as CVE-2017-0199 and CVE-2017-8759, and malicious Microsoft Publisher files

Some of the documents exploited CVE-2017-0199 to deliver the payload.

2024192 | ET EXPLOIT Possible CVE-2017-0199 HTA Inbound

2024196 | ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199

2024197 | ET CURRENT_EVENTS SUSPICIOUS MSXMLHTTP DL of HTA (Observed in CVE-2017-0199)

Exploitation: Microsoft Excel and Word documents with macros (sometimes password-protected), very recent vulnerabilities such as CVE-2017-0199 and CVE-2017-8759, and malicious Microsoft Publisher files

The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign.

Resume.rtf exploiting CVE-2017-8759 (Sep 19, 2017)

ARLUAS_FieldLog_2017-08-21.doc exploiting CVE-2017-8759 (Sep 19, 2017)