Nice Try Tonto Team

Group-IB detected and blocked targeted spear-phishing emails in 2021–2022 that used Royal Road RTF weaponized documents to deploy Bisonal.DoubleT backdoors and a new downloader (TontoTeam.Downloader/QuickMute); the report provides static and dynamic analysis, C2 patterns, file and network IoCs (hashes, IPs, domains), YARA detection rules, and MITRE ATT&CK mappings and attributes the activity with high confidence to the Tonto Team APT, warning of ongoing espionage targeting IT and cybersecurity organizations.