Red team tool ‘MacroPack’ abused in attacks to deploy Brute Ratel

Cisco Talos researchers report that the MacroPack red-team framework is being abused in the wild to generate malicious Office documents that deliver payloads including Havoc, Brute Ratel, and PhantomCore across multiple clusters (China, Pakistan, Russia, U.S.). The documents use multi-stage VBA that loads malicious DLLs, employ obfuscation (Markov-chain renaming, string encoding) and include four consistent non-malicious VBA subroutines that act as a MacroPack Pro fingerprint; observed communications include DoH and CloudFront and targets range from military-themed lures to spoofed forms.