LockBit Ransomware Distributed via Word Files Disguised as Resumes

AhnLab ASEC reports that LockBit 3.0 ransomware is being distributed through malicious Word documents (often disguised as resumes) that reference external DOTM templates in settings.xml.rels; these templates contain obfuscated VBA macros which run PowerShell to download and execute LockBit executables. The report includes example malicious document names, identified external DOTM and EXE URLs, MD5 hashes for DOTM/DOCX/EXE artifacts, and screenshots of infection and ransom notes, and warns that various malware families are using the same resume-themed lure.