Hackers Use MS Excel Macro to Launch Multi-Stage Malware Attack in Ukraine

A multi-stage malware campaign targeting endpoints in Ukraine uses a malicious Excel document with an embedded VBA macro to deploy a HEX-encoded DLL downloader via regsvr32. The downloader performs geo-location checks (restricting further payload download to Ukrainian devices), checks for security tooling (e.g., Avast, Process Hacker) to abort if detected, and launches chained DLLs culminating in a Cobalt Strike Beacon that communicates with a C2 server (simonandschuster.shop); the attack employs obfuscation, self-deletion, injector delays, and parent-process termination to evade analysis and sandboxing.