Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack

McAfee analysts observed APT28 distributing malicious Word documents themed around a recent NYC terror attack that abuse Office's DDE feature to run PowerShell and download the Seduploader reconnaissance DLL (vms.dll / secnt.dll). The report includes technical details of the DDE/PowerShell commands, decoded scripts, compile dates, control domains/IPs, SHA1 hashes, and notes the actor likely uses Seduploader as a first-stage implant before deploying X-Agent or Sedreco.