Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. In the first scenario, Talos discovered a document named "MinutesofMeeting-2May19.docx", that appeared to display the national flag of Jordan. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine