Microsoft DDE protocol based malware attacks

This Zscaler ThreatLabz analysis describes active exploitation of Microsoft Word's DDE feature to deliver and execute malware (via PowerShell) across multiple campaigns: a PowerShell-Empire based post-exploitation chain, Locky ransomware distribution, and an APT28-linked campaign delivering Seduploader spyware. The report includes technical details (download URLs, IPs, RC4/AES/RSA behavior, registry persistence, scheduled tasks, cookie, and obfuscated scripts), observed TTPs, and mitigation advice (decline DDE prompts, registry disable, Microsoft advisory).