Multiple threat actors have been recently discovered utilizing a new vulnerability within Microsoft Windows MSHTML. This vulnerability, classified as CVE-2021-40444, is a flaw within MSHTML which allows for threat actors to deploy a remote code execution (RCE) to create infected Microsoft Office files and documents. Researchers have discovered multiple campaigns utilizing this exploit in order to distribute custom-made Cobalt Strike Beacon loaders which communicate with multiple cybercriminal groups. Early use of this vulnerability has been attributed to Ryuk ransomware threat actors, utilizing the exploit in several campaigns prior to the patch release this week. Additionally, three DEV threat groups, DEV-0365 / DEV-0193 / DEV-0413, have also been seen leveraging this vulnerability to deploy various amounts of malicious entities. Threat actors also utilized social engineering tactics for delivery of the initial payload, impersonating legal contracts and agreements to sway the target user to open the malicious files. Remediation for this vulnerability has some in the form of a Microsoft Windows patch from earlier this week. Companies are urged to update their systems as soon as feasibly possible. CTAPT will continue to investigate threat actors that are utilizing this vulnerability and provide updates if needed.