Spear-Phishing RTF Hits Bangladesh Defense Targets

How the Attack Worked

This campaign, reported by Cyderes and attributed to the DoNot Team, targeted Bangladesh's military and defense establishments using spear-phishing emails containing a malware-laced RTF document. The lure asked recipients to review an attached RTF file, a simple and familiar request designed to lower suspicion among busy staff handling routine paperwork.

Once opened, the RTF used remote template injection to fetch a VBA macro. This macro then kicked off a multi-stage attack chain: shellcode execution, delivery of a DLL implant, and persistence achieved through a scheduled task disguised as OneDrive telemetry. The implant profiled the host and then beaconed to a command-and-control server over HTTPS, blending its traffic in with normal encrypted web activity.

Why It Succeeded

A few design choices made this operation particularly effective:

• The pretext relied on a routine document review request rather than an urgent or alarming message, which can reduce hesitation.
• Server-side geofencing restricted payload delivery to victims inside the target region, limiting exposure to security researchers and automated sandboxes outside that area.
• The attack chain used legitimate-sounding disguises, such as naming the scheduled task after OneDrive telemetry, to blend into normal system activity and evade casual inspection.
• HTTPS beaconing to command-and-control let the implant's outbound traffic look like ordinary encrypted web traffic.

Together, these choices reflect high attack sophistication, prioritizing stealth and precision targeting over broad, noisy distribution.

What to Watch For

Defenders and staff in military, government, and defense-adjacent roles should be alert to:

• Unexpected RTF or other document attachments, even if they appear to relate to routine work.
• Documents that prompt you to enable content, run macros, or that seem to pull additional data from the internet after opening.
• Messages with subtle urgency pushing you to open an attachment quickly, even when the overall tone seems ordinary.
• Unusual persistence artifacts, such as scheduled tasks named after common cloud services like OneDrive, which can be used as cover.

Building Resistance

Organizations in government, military, and defense sectors can reduce risk by training administrative and leadership staff to treat unsolicited document attachments as inherently risky, particularly RTF files that could trigger remote content retrieval. Staff should be encouraged to report suspicious attachments rather than open them, even when the message appears routine or plausible. Because this campaign used regional targeting and multi-stage payload delivery, awareness programs should emphasize that even normal-looking, role-relevant emails can carry hidden malicious document workflows, and that reporting first is always the safer choice.

What made this RTF attachment dangerous?

The RTF used remote template injection to fetch a VBA macro, which then triggered a multi-stage attack chain including shellcode, a DLL implant, and persistence disguised as OneDrive telemetry.

Who was targeted in this campaign?

The campaign targeted Bangladesh's military and defense establishments, along with government employees and administrative staff who handle documents.

How did the attackers limit who received the payload?

The attack used server-side geofencing to restrict payload delivery to victims located inside the target region, making the operation harder to detect broadly.

What should employees watch for to avoid similar attacks?

Treat unexpected RTF or document attachments as high risk, especially those that try to pull additional content from the internet or run embedded macros, and report them instead of opening them.