Analysis Of SandWorm (CVE-2014-4114) 0-Day

**Executive summary:** This report analyzes an in-the-wild zero-day exploit (CVE-2014-4114) delivered via a malicious PowerPoint Slide Show (spiski_deputatov_done.ppsx) that uses embedded OLE objects to retrieve a BlackEnergy executable disguised as a GIF and an INF file (slides.inf) that renames and executes the payload; the campaign is linked to a possible Russian espionage effort targeting NATO, EU, telecommunications, and energy sectors and Zscaler's engines detected and blocked the sample.