Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack

McAfee Labs reports that APT28 distributed malicious Word documents (e.g., IsisAttackInNewYork.docx, SaberGuardian2017.docx) which use Microsoft Office DDE to execute PowerShell, download the Seduploader DLL payload (vms.dll/secnt.dll), and establish control via domains such as webviewres.net and netmediaresources.com; the report includes file hashes, compile dates, control servers, IPs, and analysis linking the samples to previous APT28 activity and techniques.