Double the Infection, Double the Fun

ASERT reports an active Cobalt Group campaign targeting financial institutions (notably in Russia and Romania) using spear-phishing with dual malicious links: a weaponized Word macro that stages a regsvr32/cmstp-based infection chain dropping a JavaScript backdoor (“more_eggs”), and an executable masquerading as a JPEG tied to CobInt/COOLPANTS reconnaissance backdoors; the report includes TTPs, multiple C2 domains, and a detailed set of IOCs for detection and blocking.