Gamaredon targets Ukraine using CVE-2017-0199

From September 2019 to November 2019, there has been a significant uptick in Gamaredon attributed activity. A series of Word documents taking advantage of CVE-2017-0199 have been uploaded to VirusTotal, mostly by submitters in Ukraine. The initial dropper documents do not make use of malicious macros or OLE objects, but rather reference external Document Template […]