Nation-backed threat groups have been seen adopting and executing a fairly new attack technique called “RTF Template Injection”. This new tactic is a variation of a template injection, in which adversaries modify Microsoft Office templates to conceal malicious scripts or allow authentication into the system. In this version, rather than utilizing the backing of Office documents/templates, threat actors have launched attacks through Windows RTF’s (rich text files), which support arranging content using a template stored on a remote URL address. Thus far, three advanced persistent threat (APT) groups have been seen utilizing this new tactic in their attacks; DoNoT (India), TA423 (China), and Gamaredon (Russia). These attacks occurred earlier on this year in March, when DoNoT threat actors registered associated domains and proceeded to launch the RTF attacks roughly a month later. DoNoT actors continued these attacks until mid-July, while TA423 actors were recently seen utilizing the tactic to exploit Malaysian energy companies; which were involved with deep-water energy exploration. Gamaredon threat actors, which were exposed recently as being under control of the Russian FSB intelligence service, deployed their attacks against Ukraine government entities. CTAPT is actively gaining additional insight to this new threat actor tactic and will monitor these actors accordingly.