Adwind Dodges AV via DDE

Summary: Cisco Talos researchers Paul Rascagneres and Vitor Ventura, with contributions from ReversingLabs' Tomislav Pericin and Robert Perica, documented an Adwind RAT v3.0 campaign that uses forged Microsoft Office documents and DDE to execute code, with most targets in Turkey and some in Germany. Umbrella data showed 75 percent of DNS requests came from Turkey, matching Turkish-language spam emails that carried CSV and .XLT attachments and lured users with a message about footwear costs.
Why it matters: The dropper pads files with random data so anti-virus skips scanning them, and the payload is a multiplatform RAT configured for persistence on Windows, Linux and Mac OSX that can log keystrokes, take screenshots and transfer files.

Read the original at Cisco Talos ↗

Topics: Cloud Security
Related: Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026
Cloud-Native Security in 2025: Why Runtime Visibility Must Take Center Stage Cyber Risks ·