OTX Threat: Beware of Phishing Emails That Disguise Themselves as Project Material Purchase Requests

ASEC identified a phishing campaign targeting organizations in Korea through emails impersonating company employees. The emails contain malicious XLS files disguised as project material purchase request forms. When opened, the documents exploit CVE-2017-0199, an OLE2Link vulnerability in Microsoft Office, to download HTA files from a C2 server. The HTA file executes an obfuscated PowerShell script CVEs: CVE-2017-0199