200407-MWB-COVID-White-Paper_Final.pdf

This Malwarebytes Threat Intelligence report catalogs multiple APT actors and COVID-19-themed campaigns observed in early 2020, describing how adversaries (e.g., Kimsuky, Gamaredon, Konni, TA505, TA542, Mustang Panda, Winnti/Chinox, Calypso) used template injection, malicious macros, RTF Equation Editor exploits, and malicious LNK shortcuts to deliver spyware, RATs and other malware. The report includes technical details and examples (embedded macros, scripts, C2 URLs, dropped filenames), references exploited CVEs such as CVE-2017-0199 and CVE-2017-11882, and lists observed indicators of compromise and persistence mechanisms.