The APT37 threat group was discovered exploiting a remote code execution vulnerability in Windows Scripting Languages (CVE-2022-41128).
The initial infection vector consisted of malicious Microsoft Office documents along with a rich text file (RTF) remote template.
Successful exploitation requires the victim to disable protected view before the remote RTF template is downloaded.