LinkedIn information used to spread banking malware in the Netherlands

Fox-IT detected a Dutch-language, targeted phishing campaign delivering macro-enabled Word documents named with recipient-specific details; the macro fetches a binary (ledpronto.com/app/office.bin, sha256:c1e21a06a1fa1de2998392668b6910ca2be0d5d9ecc39bd3e3a2a3ae7623400d) identified as the Zeus Panda banking trojan that communicates with a C2 at skorianial.com (107.171.187.182). Recipients are social-engineered via LinkedIn-derived personal details and advised to scan systems if the attachment was opened and macros enabled.