7-Year-Old 0-Day in Microsoft Office Exploited to Drop Cobalt Strike

Deep Instinct identified a targeted campaign against Ukrainian systems that leveraged an old Microsoft Office vulnerability (CVE-2017-8570) in a malicious PPSX lure to deploy a cracked custom Cobalt Strike Beacon loader; operators used obfuscated script URLs and deceptive domains (weavesilk.space, petapixel.fun), staged infrastructure across multiple countries, and evaded easy attribution, highlighting the continued risk from legacy vulnerabilities and sophisticated C2 tooling.