Mimecast

Document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an attached Office Document and PDF file that both contain embedded links to an Adobe-spoofing site that delivers a Malicious Batch Script. When run, the script downloads GoTo RAT.

U.S. Small Business Administration-spoofing, document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver a link leading to an Adobe-spoofing website which delivers an Adobe-spoofing Zecurit RAT executable.

Finance-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to a Malicious Batch Script that downloads ConnectWise RAT.

Docusign-spoofing, document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an HTA via an embedded URL. The HTA delivers ConnectWise RAT.

Notification-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to a Credential Phishing site.

Document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver ConnectWise RAT or Credential Phishing based on browser fingerprinting.

IRS-spoofing, taxes-themed emails found in environments protected by MimeCast deliver an embedded link to ConnectWise RAT.

Champion Healthcare Solutions-spoofing, document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to an OAuth 2.0-based Credential Phishing site.

Document-themed emails found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP deliver an embedded link to a credential phishing site.

Document-themed campaign found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP delivers MSP360 RMM via an embedded URL. MSP360 RMM delivers ConnectWise RAT.

Nike-spoofing, job application-themed emails found in environments protected by Abnormal Security,  Mimecast, and Microsoft ATP deliver an embedded link to a Nike-spoofing website that contains a Facebook-spoofing Credential Phishing page.

Oklahoma Cancer Specialists and Research Institute-spoofing, response-themed emails found in environments protected by Mimecast, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Credential Phishing site and ConnectWise RAT.