New RAT in Macro-Based Docs Using AppLocker Bypass

This Zscaler ThreatLabZ report analyzes a low-volume targeted campaign (Feb–May 2020) that used macro-enabled Word documents themed around London tech events to deliver a previously unobserved .NET RAT dubbed "ShellReset." Malicious macros drop obfuscated C# source, compile it at runtime with csc.exe or msbuild.exe (bypassing AppLocker/Device Guard), and execute a RAT that registers with C2, supports remote shell execution, directory listing, file exfiltration (via AWS upload URLs), screenshot capture, and startup persistence; the report includes file hashes, hosting and C2 domains, API endpoints, and MITRE ATT&CK mappings.