Researchers at Cisco Talos recently discovered a new campaign utilizing a twenty-year-old Microsoft Office vulnerability to target entities in Afghanistan and India. CVE-2017-11882, a Microsoft Office Equation Editor flaw that was patched in November 2017, was seen exploited by the threat actor behind the campaign in order to deliver various Windows and Android remote-access tools (RATs) to victims’ machines (such as “dcRAT”, “QuasarRAT”, and “AndroRAT”/”AndroidRAT”). The campaign involves multiple “political and government-themed malicious domains” that contain a laced Rich Text Format (RTF) document. After a victim downloads the RTF, two phases of the campaign occur: a reconnaissance phase involving a “custom file enumerator and infector” and an attack phase involving the RAT deployments. The RATs have various capabilities, including credential exfiltration, arbitrary code execution, keylogging, file and process management, and more. Cisco Talos, in their report linked below, noted that the threat actor involved is operating under the moniker “A.R. Bunse” and a fraudulent Pakistani IT firm called “Bunse Technologies”. “Bunse Technologies”, otherwise known as “BunseTech”, is “a software development and marketing agency based out of Lahore, Pakistan” and was identified to be the issuer of the malicious domains’ SSL certificates. Researchers also explained that the company’s domain was registered in April of 2020 but is currently down. The company, however, still has a presence on Facebook and Twitter. Researchers determined, based on the identified lures and decoys, that the main victims of the attacks are “Indian and Afghan government and diplomatic entities”. An in-depth analysis of the malicious campaign as well as the threat actor/”Bunse Technologies” can be reviewed in Cisco Talos’ report, along with a large number of indicators of compromise (IOCs) at the conclusion.