Some lure documents used in these attacks are shown below: Decoy documents used in BlackOasis attacks To summarize, we have seen BlackOasis utilizing at least five zero days since June 2015:  CVE-2015-5119 – June 2015 CVE-2016-0984 – June 2015 CVE-2016-4117 – May 2016 CVE-2017-8759 – Sept 2017 CVE-2017-11292 – Oct 2017  Attacks Leveraging CVE-2017-11292 The attack begins with the delivery of an Office document, presumably in this instance via e-mail.  Embedded within the document is an ActiveX object which contains the Flash exploit