Privileges and Credentials: Phished at the Request of Counsel

FireEye details a multi-stage phishing campaign attributed to APT19 targeting global law and investment firms, using RTF exploits and macro-enabled Excel documents to deploy a Cobalt Strike BEACON, with an application whitelisting bypass and a comprehensive set of indicators, network IOCs, and recommended mitigations for detection and response.