The xlsb mail attachment contacts a url and downloads the malware from an opendir, which also contains Ursnif/Gozi and is constantly updated.
In Badia the war between the Syrian army (SAA) and Isis continues. The soldiers aim to remove the jihadists from the Deir Ezzor-Homs highway
The war between the Syrian army (SAA) and Isis continues in the Badia desert between Deir Ezzor, Raqqa, Hama and Homs. The jihadists carried out surprise attacks on checkpoints in the three areas. In addition, they scattered mines in the roads to hit enemy vehicles that pursued them or that got too close to the militiamen. The SAA, on the other hand, has launched a new anti-IS operation on the highway between Deir Ezzor and Homs (from the west of the province to al-Suknah), in which the Russian air component participates. Objective: to stop the wave of ambushes on military convoys heading east, which have already caused dozens of deaths and injuries among soldiers. Damascus, in fact, needs to regain full control of the road to be able to safely move men and assets to be used in the campaign against terrorists in the quadrant.
IS, meanwhile, is trying to raise funds by extorting shepherds with the excuse of zakat
Meanwhile, Isis is strengthening its defenses between Deir Ezzor and Homs and is trying to raise cash to finance itself. Several pastors in al-Suknah have in fact reported being extorted by IS jihadists. According to local sources, dozens of people have already suffered extortion, for a total value of over a thousand euros. The system is always the same: a group of militiamen, disguised as soldiers of the SAA, goes to the shepherds’ tents and forces them to pay the zakat. The funds, however, instead of being handed over to the imams to be allocated to those most in need, remain in the coffers of the jihadists. In some cases, livestock was also seized as an “alternative payment”. This means that the militiamen are short of resources and that the Syrian army offensive is making it difficult to find them through traditional channels.