TA2101 is found targeting German companies and organizations to deliver and install backdoor malware. This actor is distributing Maze ransomware through Microsoft Word attachments, which when opened execute a Microsoft Office macro that, in turn, executes a PowerShell script, which downloads and installs the Maze ransomware payload onto the victim’s system.
The lure appears to be a notification of law enforcement activities (“aggiornamento: attivita di contrasto all’evasione”) and states that the recipient should open and read the enclosed document in order to avoid further tax assessment and penalties.
The emails, as part of a low-volume campaign across multiple verticals, were targeted primarily at manufacturing companies, businesses and IT service companies and used an infection chain of Microsoft Office macros into a PowerShell script, which ultimately downloads and installs Maze ransomware. Opening the Microsoft Word Document and enabling macros installs Maze ransomware on the user’s system, encrypting all of their files, and saves a ransom note resembling the following in TXT format in every directory.