An APT campaign targeting Malaysian users that they believe is being carried out by the Leviathan APT (aka ITG09, APT40). The initial lure document, likely sent via spear phishing emails. When opened, a remote template is downloaded in the background. The remote template, in turn, executes VBA macro code that is responsible for unpacking and executing two DLLs. The first DLL downloads a benign executable and a malicious DLL. The second DLL dropped by the VBA code runs the benign executable, which leads to the malicious DLL being executed due to DLL search order hijacking. The side-loaded DLL is a first-stage backdoor that downloads an additional file, decrypts it, executes it in memory, and deletes the downloaded file. Once running in memory, this additional file acts as a second-stage backdoor providing various capabilities, such as anti-debug checks, file discovery, upload, and download, establishing persistence, and command line execution. The C2 server is operated via dynamic DNS. Both the TTPs and string similarities within the payloads leads the researchers to believe this activity is being carried out by Leviathan.