Hagga__2019__Aggah_Campaign_Bit.ly_BlogSpot_and_Pastebin_Used_for_C2_in_Large_Scale_Campaign.pdf

Unit 42 analyzed the 'Aggah' campaign (Mar–Apr 2019) that uses malicious Word/RTF/Excel macros and template injection to run mshta and follow a Bit.ly -> Blogspot -> Pastebin chain to download and execute a VB.NET RevengeRAT payload; the malware disables Defender/Office protections, establishes persistence via scheduled tasks and Run keys, and communicates with duckdns/DDNS C2 domains (many IOCs and file hashes provided). Attribution remains uncertain (some behavioral overlap with the Gorgon Group), and the report provides detailed IOCs and mitigation coverage.