![John Lambert on Twitter: "#NATO document lure with a little bit of a VBA & #PowerShell attitude: https://t.co/QjL980sim4 3140d913ff1b77328bb3065b78da726c0d04abd8 https://t.co/UHDf1nSQGW" / Twitter John Lambert on Twitter: "#NATO document lure with a little bit of a VBA & #PowerShell attitude: https://t.co/QjL980sim4 3140d913ff1b77328bb3065b78da726c0d04abd8 https://t.co/UHDf1nSQGW" / Twitter](https://pbs.twimg.com/media/C7JHppuU8AAvMdS.jpg)
John Lambert on Twitter: "#NATO document lure with a little bit of a VBA & #PowerShell attitude: https://t.co/QjL980sim4 3140d913ff1b77328bb3065b78da726c0d04abd8 https://t.co/UHDf1nSQGW" / Twitter
Arkbird on Twitter: "As persistence push in HKEY_CURRENT_USER\Software\Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\InprocServer32 (who are the PlaySoundService InprocServer) for run the payload in appdata. https://t.co/XOtv5EKDHX https://t.co ...
![Check Point Research on Twitter: "#Afrodita Ransomware, appears to be a new strain. Targeting businesses in Croatia via legitimate looking Excel spreadsheets. Subject: “Poziv na placanje” DZ: http://content-delivery[.]in/verynice.jpg XLSM ... Check Point Research on Twitter: "#Afrodita Ransomware, appears to be a new strain. Targeting businesses in Croatia via legitimate looking Excel spreadsheets. Subject: “Poziv na placanje” DZ: http://content-delivery[.]in/verynice.jpg XLSM ...](https://pbs.twimg.com/media/EK42UTgWwAAPoK7.jpg)