Trusted Design

Malware delivered via Necurs botnet by DDE feature in Microsoft Word

概要

Another change from the Necurs botnet delivering locky and Trickbot again today with an email with the subject of Emailed Invoice – 459572 ( random numbers) pretending to come from random names at your own email address or company domain. I am not entirely sure what malware we have today but it doesn’t at first glance look like either Locky or Trickbot

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• more Necurs botnet sent fake invoices deliver malware My Online Security (score: 0.72)
• NECURS BOTNET MALSPAM STOPS USING DDE, STILL USES WORD DOCS TO PUSH LOCKY (score: 0.69)
• Necurs Botnet malspam stops using DDE, still uses Word docs to push Locky (score: 0.67)
• Spam: Close Invoice Finance Limited Statement 1/1 (score: 0.67)
• Tale of the Two Payloads – TrickBot and Nitol (score: 0.67)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る