Such intrusions, which Ukraine’s Computer Emergency Response Team associated with the Russian threat operation UAC-0194, commenced with the delivery of phishing emails with a URL file, which when interacted exploits the vulnerability to facilitate installation of additional payloads, including the open-source trojan SparkRAT, an analysis from ClearSky researchers showed. Additional findings revealed the exploitation of the Server Message Block protocol to enable attempted NTLM hash exfiltration.

Source: SC Magazine