Content Researchers have discovered that MacroPack – an attacker emulation software – is being abused by multiple cyber threat actors. MacroPack is a proprietary tool leveraged by red and purple teams to test prevention and detection mechanisms. Security researchers discovered its use for nefarious purposes by analyzing document submissions made to VirusTotal from around the globe. Submissions from the United States, China, Russia, and Pakistan indicate that MacroPack had been used to craft malicious VBA code delivered via Microsoft Office documents to spread final malware payloads such as Havoc, Brute Ratel, and PhantomCore. The documents analyzed all contained VBA subroutines embedded in the documents which indicate they had been created using MacroPack. Researchers believe that multiple different threat actors are behind these campaigns given the variation of lures and targets related to the identified documents. MacroPack includes advanced features that threat actors can abuse, such as anti-malware bypass techniques, code obfuscation, and undetectable VB scripts. Once a victim opens an infected document, MacroPack decodes a shellcode stage which then kicks off a DLL payload that connects to a command-and-control (C2) server. Final payloads observed include post-exploitation C2 tools such as Havoc and Brute Ratel and Remote Access Trojan (RAT) Phantom Core. Brute Ratel is a post-exploitation attack framework much like Cobalt Strike. CTIX analysts recommend that organizations utilize Endpoint Detection and Response (EDR) and Next-Generation Anti-Virus (NGAV) to prevent and detect these types of threats, and to ensure the Indicators of Compromise (IOCs) related these campaigns are blocked. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.