Vanja Svajcer (@vanjasvajcer.bsky.social)

I started looking at this because a document uploaded to VT was similar to documents with Picasso loader and I thought it could be a new variant. It turns out there is generator MacroPack generating these docs. blog.talosintelligence.com/threat-actor...

loading . . .

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads The threat of VBA macros has diminished since Microsoft prevented the execution of macros in Microsoft Office documents downloaded from the internet, but not all users are using the latest up-to-date ... https://blog.talosintelligence.com/threat-actors-using-macropack/