AeroBlade__2023__Blackberry_AeroBlade-Targeting-US-Aerospace-Industry_11-30-2023.pdf

BlackBerry uncovered a previously unreported threat actor dubbed AeroBlade conducting targeted commercial cyber-espionage against a U.S. aerospace company via spear-phishing Word documents that use remote template injection and malicious macros to deploy an obfuscated DLL reverse shell; the report provides detailed technical analysis, MITRE ATT&CK mapping, persistence and anti-analysis techniques, C2 infrastructure, and IoCs.