The xlsb mail attachment contacts a url and downloads the malware from an opendir, which also contains Ursnif/Gozi and is constantly updated.
Turkey is determined to take control of M4 in Kurdistan. The bombing of Ain Issa and the military build-up of the TAF in the area continue
Turkey continues to bomb Ain Issa to extend its buffer zone beyond the M4 in Kurdistan and push inland towards Raqqa and Hasaka. The city was targeted by artillery from allied TAF militias for the seventh consecutive night. Meanwhile, Ankara continues to strengthen its military presence in the villages along the highway in the Syrian province. The SDF are in a state of maximum alert and are sending reinforcements to the quadrant, but for now they are not responding to the attacks. It is feared, in fact, that any reaction or incident could be used as an excuse by Recep Tayyp Erdogan’s troops to attack the town in Kurdistan. This is all the more reason for the fact that, unlike Idlib, there is no agreement with Russia that prevents it.
Meanwhile, the SAA still clashes with Isis in the Badia desert. The toll is 30 deaths among IS soldiers and jihadists. Damascus, not even with the help of Russia, manages to eliminate the pockets of resistance of the terrorists in the quadrant
Further south, however, the Syrian army (SAA) clashed again with Isis. The battle, which also took place in the Badia al-Sham desert, caused about thirty deaths of which 13 are among the ranks of the jihadists and at least 16 among the soldiers. The clashes focused in particular on the Al-Rahjan and Athria axis east of Hama, as well as in the Aleppo-Hama-Raqqa triangle, and saw intense participation from the air component. The SAA continues to launch offensives in the area and further east towards Deir Ezzor to try to eliminate the large pockets of IS resistance, but to no avail. These, in fact, continue to attack military bases and convoys relentlessly. Not even Russia, which has intervened several times with fighters, has so far failed to make a difference.