SOC Alert! Uptick in Ursnif Distribution

Ursnif is being distributed via reply-chain attacks using password-protected ZIPs with macro-enabled documents; the campaign uses a multi-stage loader that injects a malicious DLL into iexplore.exe, employs registry-based fileless persistence to re-execute, and communicates with listed C2 domains. Block the provided C2 domains, do not execute macros, and prioritize rapid remediation because infected hosts often receive Trickbot as a follow-on payload.