“Cyber Conflict” Decoy Document Used In Real Cyber Conflict
Summary: Cisco Talos reported a campaign by Group 74 (also known as Tsar Team, Sofacy, APT28, Fancy Bear) that used a decoy flyer for the Cyber Conflict U.S. conference, named Conference_on_Cyber_Conflict.doc, to deliver a new Seduploader variant. The document carried no Office exploit or 0-day, only a VBA macro that pulled base64-encoded data from document properties, wrote a PE file named netwf.dat, and executed it via rundll32.exe, dropping netwf.bat and netwf.dll and setting them to Hidden.
Why it matters: The lure was built for people who follow cybersecurity, and the payload ran without any exploit, so signature-based detection of Office exploits would not have caught it; the actor also changed the XOR key and MUTEX name (FG00nxojVs4gLBnwKc7HhmdK0h) to evade public IOCs.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026