Patchwork APT Group Targets US Think Tanks

Each of the spear phishing attacks contained links to .doc files, which were really RTF documents that attempt to exploit CVE-2017-8570 (Composite Moniker).

The threat actors appear to have leveraged publicly available exploit code that can be found on Github at the URL: https://github.com/rxwx/CVE-2017-8570.

Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document.

Note: The scriptlet code is an exact match to that shown on the Github page referenced earlier for CVE-2017-8570.

| Notes | Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe.