Seven Days Of The Collect Exfiltrate Sleep Repeat Spin Cycle

Threat actors targeted users in a phishing campaign that delivered a job application themed macro enable document. If the unsuspecting recipient executed the document and enabled the macro VBS and PowerShell files were created for further compromise of the machine. The malicious scripts made use of many OS native tools as well as some legitimate open source packages to carry out nefarious tasks. Scheduled tasks were created to gather system information gather local and domain user account and install a keylogger that was developed from the opensource software AutoHotkey. Although the attackers successfully acquired access and exfiltrated some collected data the attackers were not seen carrying out further actions on the victim machines.