Attackers are using spearphishing emails containing malicious links to deliver malware that uses Rundll32 and Mshta for defense evasion.
Suspected TTPs:
- Initial Access: Spearphishing Link
- Execution: Rundll32
- Defense Evasion: Mshta
Tag: Mshta
Game of Emperor
The threat actor has gained initial access and is utilizing various defense evasion techniques to avoid detection while establishing persistence and maintaining control.