A new, previously undocumented hacking group coined ‘AeroBlade’ was recently discovered targeting United States aerospace organizations in what are believed to be a series of attacks as part of a cyber espionage campaign. The group’s origins are currently unknown, and it has yet to be determined whether the attacks were successful, but researchers speculate the purpose of mission was likely motivated by data theft or extortion. The attacks consisted of two (2) stages. The first stage began in September 2022 with the deployment of spear-phishing emails containing a document (docx) attachment with an embedded remote template injection to download the second-stage DOTM file. The second stage connects the attacker’s command and control (C2) server by executing malicious VBA macros that enable a reverse shell on the target’s system. During the first stage delivery mechanism, the victim opens a readable Microsoft Word document that appears legitimate while simultaneously dropping the next-stage payload that’s executed once the victim manually clicks the “Enable Content” lure message. The second stage of the attacks didn’t occur until July 2023, leading to the reverse shell payload consisting of a heavily obfuscated dynamic-link library (DLL) connecting to a hard-coded C2 server that transmited system information, including lists of all directories on the compromised computer, back to the attacker. The obfuscated DLL file features anti-analysis and anti-disassembly techniques that make detection and analysis difficult, while also skipping execution on sandboxed environments. Lastly, the payload established persistence on the system by means of a Task Scheduler, with a task named “WinUpdate2”. Between the time of the two (2) attack phases, it was observed that the threat actor put a considerable amount of effort into the development of additional resources, indicating the evolution of their tools and growing sophistication capabilities of their attacks.