--- title: "Alert: Malware Campaign Targeting US-Based Organizations" description: As a new wave of malware-focused phishing attacks gain popularity, our expert security engineers are on the frontlines. Here's what you need to know. image: https://blog.teamascend.com/hubfs/Blog%20Assets/Blog%20Feature%20Images/Alert-PhishingMalware_073020.jpg --- [Skip to main content](https://blog.teamascend.com/blog/alert-malware-campaign-targeting-us-organizations#main) [![cropped-Ascend-Technologies\_Vertical\_FullColor\_White](https://blog.teamascend.com/hs-fs/hubfs/Logos/cropped-Ascend-Technologies_Vertical_FullColor_White.png?width=150&height=118&name=cropped-Ascend-Technologies_Vertical_FullColor_White.png) ![cropped-Ascend-Technologies\_Vertical\_FullColor\_White](https://blog.teamascend.com/hs-fs/hubfs/Logos/cropped-Ascend-Technologies_Vertical_FullColor_White.png?width=150&height=118&name=cropped-Ascend-Technologies_Vertical_FullColor_White.png)](https://teamascend.com/) - [Show submenu for Services Services](http://teamascend.com/services/) - [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Healthcare Consulting](https://teamascend.com/services/healthcare/) - [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/) - [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/) - [Email Security](https://teamascend.com/services/cybersecurity/email-security/) - [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/) - [vCISO](https://teamascend.com/services/cybersecurity/vciso/) - [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/) - [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/) - [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/) - [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/) - [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [VCIO](https://teamascend.com/services/infrastructure/vcio/) - [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/) - [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/) - [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/) - [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/) - [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/) - [Product](https://teamascend.com/services/infrastructure/product/) - [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/) - [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/) - [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/) - [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/) - [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/) - [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/) - [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/) - [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/) - [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/) - [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/) - [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/) - [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/) - [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/) - [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/) - [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/) - [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/) - [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/) - [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) - [Show submenu for Industries Industries](https://teamascend.com/industries/) - [Financial Services](https://teamascend.com/industries/financial-services/) - [Private Equity](https://teamascend.com/industries/private-equity/) - [Insurance](https://teamascend.com/industries/insurance/) - [Manufacturing](https://teamascend.com/industries/manufacturing/) - [Healthcare](https://teamascend.com/industries/healthcare/) - [Legal](https://teamascend.com/industries/legal/) - [Accounting](https://teamascend.com/industries/accounting/) - [Show submenu for Resources Resources](https://teamascend.com/resources/) - [Client Success Stories](https://teamascend.com/client-success-stories/) - [Events](https://teamascend.com/events/) - [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions) - [Blog](https://blog.teamascend.com/) - [Webinars](https://teamascend.com/resources/?_resource_type=webinar) - [All Resources](https://teamascend.com/resources/) - Show submenu for Company Company - [About Ascend Technologies](https://teamascend.com/about/) - [Leadership Team](https://teamascend.com/about/team/) - [Partners With Us](https://teamascend.com/about/partner-with-us/) - [Awards & Recognitions](https://teamascend.com/about/awards/) - [Certifications](https://teamascend.com/about/certifications/) - [Careers](https://teamascend.com/careers/) - [Internships](https://teamascend.com/careers/internships/) - [Connect](https://teamascend.com/contact/) Open main navigation Close main navigation - Show submenu for Services Services - Services - [Services](http://teamascend.com/services/) - Show submenu for IT Consulting IT Consulting - IT Consulting - [IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Healthcare Consulting](https://teamascend.com/services/healthcare/) - Show submenu for Cybersecurity Cybersecurity - Cybersecurity - [Cybersecurity](https://teamascend.com/services/cybersecurity/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/) - [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/) - [Email Security](https://teamascend.com/services/cybersecurity/email-security/) - [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/) - [vCISO](https://teamascend.com/services/cybersecurity/vciso/) - [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/) - [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/) - [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/) - [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/) - Show submenu for IT Infrastructure IT Infrastructure - IT Infrastructure - [IT Infrastructure](https://teamascend.com/services/infrastructure/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [VCIO](https://teamascend.com/services/infrastructure/vcio/) - [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/) - [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/) - [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/) - [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/) - [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/) - [Product](https://teamascend.com/services/infrastructure/product/) - Show submenu for Cloud Cloud - Cloud - [Cloud](https://teamascend.com/services/cloud-computing/) - [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/) - [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/) - [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/) - [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/) - [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/) - [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/) - Show submenu for Microsoft Services Microsoft Services - Microsoft Services - [Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/) - [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/) - [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/) - [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/) - [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/) - Show submenu for Salesforce Salesforce - Salesforce - [Salesforce](https://teamascend.com/salesforce-services/) - [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/) - [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/) - [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/) - [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/) - [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/) - [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) - Show submenu for Industries Industries - Industries - [Industries](https://teamascend.com/industries/) - [Financial Services](https://teamascend.com/industries/financial-services/) - [Private Equity](https://teamascend.com/industries/private-equity/) - [Insurance](https://teamascend.com/industries/insurance/) - [Manufacturing](https://teamascend.com/industries/manufacturing/) - [Healthcare](https://teamascend.com/industries/healthcare/) - [Legal](https://teamascend.com/industries/legal/) - [Accounting](https://teamascend.com/industries/accounting/) - Show submenu for Resources Resources - Resources - [Resources](https://teamascend.com/resources/) - [Client Success Stories](https://teamascend.com/client-success-stories/) - [Events](https://teamascend.com/events/) - [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions) - [Blog](https://blog.teamascend.com/) - [Webinars](https://teamascend.com/resources/?_resource_type=webinar) - [All Resources](https://teamascend.com/resources/) - Show submenu for Company Company - Company - [About Ascend Technologies](https://teamascend.com/about/) - [Leadership Team](https://teamascend.com/about/team/) - [Partners With Us](https://teamascend.com/about/partner-with-us/) - [Awards & Recognitions](https://teamascend.com/about/awards/) - [Certifications](https://teamascend.com/about/certifications/) - [Careers](https://teamascend.com/careers/) - [Internships](https://teamascend.com/careers/internships/) - [Connect](https://teamascend.com/contact/) - [24/7 Client Services](https://portal-ascend.okta.com/) [24/7 Client Services](https://portal-ascend.okta.com/) Phishing and Security Awareness, Alerts # Alert: Malware Campaign Targeting US-Based Organizations ![Default Author](https://blog.teamascend.com/hubfs/Logos/Ascend/Ascend%20Technologies_Vertical_Blue.png) ASCEND TECHNICAL TEAM July 31, 2020 - [![LinkedIn](https://blog.teamascend.com/hubfs/LinkedIn-color%20(1).svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Falert-malware-campaign-targeting-us-organizations) - [![Facebook](https://blog.teamascend.com/hubfs/Group%203%20(1).svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Falert-malware-campaign-targeting-us-organizations) - [![Email](https://blog.teamascend.com/hubfs/Group%20427320686.svg)](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3EAlert%3A+Malware+Campaign+Targeting+US-Based+Organizations%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Falert-malware-campaign-targeting-us-organizations) ![](https://blog.teamascend.com/hubfs/Blog%20Assets/Blog%20Feature%20Images/Alert-PhishingMalware_073020.jpg) ### *As a new wave of malware-focused phishing attacks gain popularity, our expert security engineers are on the frontlines. Here's what you need to know.* Our Security Operations team has noticed an uptick in a very specific malware campaign — one that has shared many of the same attributes across every attempted attack. Based on these common factors, it has become clear that a specific malware campaign is targeting US-based organizations. At this time, the source of the attack — whether it is a single threat actor or a cyberattack group — is unknown. However, the methodology of the attack has been analyzed by our team and is detailed below. ## Here's what we've seen so far... This attack starts in the same way as a majority of successful attacks do: through email. The subject lines of these phishing emails vary from example to example, but they always start as a response. This is a common tactic used in phishing to make the recipient think this is a previous conversation and feel safe opening the message. The content of the email contains a password protected zip file attachment and instructions to open the attachment. ![IMG\_5773](https://blog.teamascend.com/hs-fs/hubfs/Blog%20Assets/Blog%20Content%20Images/IMG_5773.jpg?width=475&name=IMG_5773.jpg) Inside the zip file is a word document. The format of this document's filename often includes a menial word and then the date. An example we have seen would be “certificate.07.20.doc". When this file is opened, it executes a macro script that downloads and executes a file from a remote location using several standard Windows commands. In the screenshot below, you can see that the calls to certutil.exe and curl.exe have been obfuscated. We have observed that the domains and file names change in every attack, but the obfuscation methods have been the same. ![IMG\_5774](https://blog.teamascend.com/hs-fs/hubfs/Blog%20Assets/Blog%20Content%20Images/IMG_5774.jpg?width=733&name=IMG_5774.jpg) [Regsvr32](https://blog.teamascend.com/lolbins) has also been used every time to execute the downloaded file. This creates another file that we believe is the final malware payload. From what we’ve seen, the file name always starts with a “~” and is named what appears to be a random collection of 9 digits. This file has always been in the “ \\AppData\\Local\\Temp\\” directory. ![IMG\_5775](https://blog.teamascend.com/hs-fs/hubfs/Blog%20Assets/Blog%20Content%20Images/IMG_5775.jpg?width=467&name=IMG_5775.jpg) At this point, we’ve observed several instances of code injection as well as [command & control](https://blog.teamascend.com/phishing-and-c2) behavior as the machine continues to be infected. IPs that we’ve observed have lead back to Russia and Romania. While not yet confirmed, this fits with previous [Emotet and Trickbot](https://www.cybereason.com/blog/one-two-punch-emotet-trickbot-and-ryuk-steal-then-ransom-data) infections we’ve seen in the past. We have seen intel in the security community that there has been a recent push of Emotet, so this would align with that trend.   ## How Do I Protect Myself? This attack uses several techniques and tactics that make prevention difficult. The email addresses these messages come from are all legitimate email addresses that have been accessed through compromised credentials. Additionally, the attacker's use of a password-protected zip file as the attachment is a low-tech way to get around email antivirus scanning and sandboxing. The best defense to prevent this attack is the end user. - **If you receive an email that appears to be a response to a conversation** **you’re not sure you've had before**, chances are good its because you’ve never *actually* had the conversation. Be skeptical of something along these lines that seems out of place. - **Be very careful of attachments.** If it’s a password protected zip file, think twice before opening it. Usually, if someone is sending you a password-protected document, there’s a reason behind it that you should already know. If you’re not expecting this kind of attachment, don’t open it. - **If you open the document and it asks you to execute a macro**, again, stop and think about it. It is not normal for Word to launch macros on your machine. If you’re in a job role where you work with macros often, usually you know where these documents are coming from and will be expecting them. Therefore, following earlier advice, if you don’t know the sender or aren't expecting a document, don't open the attachment. For our customers, many of these detection mechanisms were already in place through our [EDR](http://infogressive.com/managed-security-services/mdr/edr/), [SIEM](http://infogressive.com/managed-security-services/mdr/log-analysis), and [Malware Prevention](http://infogressive.com/managed-security-services/endpoint-security/malware-prevention/) services. Using the information we’ve collected over the last 48 hours, we’ve further refined those mechanisms and are adding to our prevention capabilities in our Email Security service to advance our customers' protection against this specific attack format. Phishing and malware campaigns like this have become big business for attackers. Many times, these attacks lead to data theft and ransomware. Luckily, *because* this has become big business, the attackers are staying consistent with their tactics. Eventually the popular attack tactics will change and evolve again — but we’ll catch them next time and continue to protect our customers as we always have. Be safe and be skeptical of emails that seem out of place. [Don't get hooked!](https://blog.teamascend.com/7-signs-of-a-phishing-email) [![Free Resource: The Ultimate Guide to Spear Phishing](https://no-cache.hubspot.com/cta/default/2733374/47e815f7-a3b8-432d-ba3b-6c44bbb80c04.png)](https://cta-redirect.hubspot.com/cta/redirect/2733374/47e815f7-a3b8-432d-ba3b-6c44bbb80c04) ### Table of Contents #### Get Insights Sent to Your Inbox ## Related Articles ![How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/hubfs/software-engineers-collaborating-on-code-in-office-2026-09-21-23-15-07-utc.jpg) Phishing and Security Awareness, Alerts ### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend) September 24, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend) ![How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/hubfs/AdobeStock_1458786464.jpeg) Phishing and Security Awareness, Alerts ### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business) September 22, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business) ![What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/hubfs/woman-working-from-home-at-desk-with-laptop-2026-03-13-01-57-07-utc.jpg) Phishing and Security Awareness, Alerts ### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries) September 17, 2026 [Read Now ![arrow](https://blog.teamascend.com/hubfs/SVG%20(2).svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries) [![Ascend Technologies](https://blog.teamascend.com/hs-fs/hubfs/Logos/Ascend/Ascend%20Technologies_Horizontal_FullColor_White.png?width=200&height=107&name=Ascend%20Technologies_Horizontal_FullColor_White.png)](https://teamascend.com/) Contact 833-639-2285 - - - - - - Company - [About](https://teamascend.com/about/) - [Services](https://teamascend.com/services/) - [Testimonials](https://teamascend.com/client-success-stories/) - [Partner With Us](https://teamascend.com/about/partner-with-us/) - [Resources](https://teamascend.com/resources/) - [Contact](https://teamascend.com/contact/) - [Careers](https://teamascend.com/careers/) - Services - [IT Consulting](https://teamascend.com/services/strategic-consulting/) - [Cybersecurity](https://teamascend.com/services/cybersecurity/) - [IT Infrastructure](https://teamascend.com/services/infrastructure/) - [Cloud](https://teamascend.com/services/cloud-computing/) - [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/) - [Microsoft Services](https://teamascend.com/services/microsoft-365/) - [Salesforce Services](https://teamascend.com/salesforce-services/) - [HubSpot Services](https://teamascend.com/services/hubspot-services/) - [App Development](https://teamascend.com/services/application-development/) ### Empowering Technology. Powered by People. Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together. [Contact Us](https://teamascend.com/contact/) ©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/) ```json { "@context" : "https://schema.org", "@type" : "WebPage", "breadcrumb" : { "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.teamascend.com", "name" : "Home", "position" : 1 } ] }, "dateModified" : "2023-10-20T14🇲🇲19", "description" : "As a new wave of malware-focused phishing attacks gain popularity, our expert security engineers are on the frontlines. Here's what you need to know.", "name" : "Alert: Malware Campaign Targeting US-Based Organizations", "primaryImageOfPage" : { "@type" : "ImageObject", "url" : "https://content.teamascend.com/hubfs/Blog%20Assets/Blog%20Feature%20Images/Alert-PhishingMalware_073020.jpg" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png" }, "name" : "Ascend Technologies", "url" : "https://blog.teamascend.com" }, "url" : "https://blog.teamascend.com/blog/alert-malware-campaign-targeting-us-organizations" } ```