[demo] Attack Flow Generation

This report describes a spear-phishing campaign that uses password-protected ZIP attachments (e.g., badfile.zip) to bypass AV and deliver macro-enabled documents (.doc/.pdf/.xls) which, when executed, contact a C2 server at 1.1.1.1; noted IoCs include the sender address [email protected] and sample payload names such as malware.pdf and bad.com.