VERY IMPORTANT

In November, Intezer uncovered COVID-19 phishing lures that were used to deliver the Go version of Zebrocy. Zebrocy is mainly used against governments and commercial organizations engaged in foreign affairs. The lures consisted of documents about Sinopharm International Corporation--a pharmaceutical company that COVID-19 vaccine is currently going through phase three clinical trials--and an impersonated evacuation letter from Directorate General of Civil Aviation. The lure was delivered as part of a Virtual Hard Drive (VHD) file that requires victims to use Windows 10 to access the files.