Files packaged with Excel-DNA from which a dll containing 2 urls pointing to Discord is extracted. These download data files and encode them with XOR creating additional DLLs, which initiate the malware infection.
Russia and the SAA resume bombing HTS in Zawiya. The strikes are all concentrated on Kansafra, where there could be a large militia command center or important leaders
Russia resumes bombing the Hayat Tahrir al-Sham (HTS) and allied militias posts south of Idlib. In the past few hours there has been new rounds of air raids, like the previous ones focused on Kansafra (Zawiya). the Syrian Army (SAA) attacked the city, Kafr Aweed and Sufuhun with artillery. It is not clear what the target is, but it seems to be very important. In fact, strikes have been concentrated for over a week in this area, on an almost daily basis. For some time, the SAA and the Moscow forces have changed their strategy. The first raises the pressure on the fundamentalists by surprise, while the latter attack a specific target. There is no official confirmation, but according to local sources are said to be undergoing a hunt for the leadership or important command centers of HTS, which could be located in Zawiya.