IcedID Macro Ends in Nokoyawa Ransomware

Threat actors have moved to other means of initial access, such as ISO files combined with LNKs or OneNote payloads, but some appearances of VBA macro’s in Office documents can … Read More

The post IcedID Macro Ends in Nokoyawa Ransomware appeared first on The DFIR Report.

access adfind cobaltstrike dfir documents files icedid initial access iso macro nokoyawa nokoyawa ransomware office onenote ransomware report the dfir report threat threat actors vba vba macro xls