One Target List, Six Weeks of Conference Invites

A targeted spearphishing campaign delivered malicious PDF 'brochure' attachments to at least five named employees at a pharmaceutical contract development and manufacturing organization over six weeks using an attacker-owned domain with valid SPF/DKIM/DMARC and aged registration; the payload was flagged by an attachment scanner (MD5: 71d2f2f9896c628ca1e0e16a1b366c33) and mitigated before user action. The report emphasizes that domain/authentication and reputation checks were ineffective because the attacker used properly configured, aged infrastructure and built a sending history, and recommends focusing on payload verdicts and per-recipient behavioral context while sweeping tenants for related messages.