Yoroi security firm uncovered a targeted attack against one of the most important companies in the Italian Naval Industry leveraging MartyMcFly Malware. The attacker asked for a quotation of the entire spare part list available on the spreadsheet. In such a way the victim needed to open-up the included Microsoft spreadsheet in order to enumerate the fake customer needs. The Payload exploits CVE-2017-11882 by spawning the Equation Editor, dropping and executing an external file. We are introducing a new stage: the Stage4y87qq(stage4)”]
Source: https://securityaffairs.co/wordpress/77195/malware/martymcfly-malware-cyber-espionage.html