TrendLabs: Spam Runs Against Russian Banks

Figure 2: Infection chain of Cobalt’s latest spear phishing campaign using malicious macro
REF: http://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/