Stairwell threat report - The origin of APT32 macros

Stairwell's report dissects a 2017 leaked RAR named “StrikeSuite Gift” containing source code, macros, shellcode, and tooling used to build Office-lure malware; it documents developer artifacts, debug symbols, PDB paths, scheduled-task XML timestamps, obfuscation routines, and network indicators, and ties components (notably a ShellcodeLoader L.dll and XML timestamps) to APT32/OceanLotus, providing YARA rules and guidance to detect related artifacts.