Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks

A financially motivated threat actor launched tailored spear phishing campaigns targeting retail, restaurant, and hospitality industries. They used Microsoft Word documents with embedded macros to download and execute a malicious downloader, PUNCHBUGGY, to compromise systems and move laterally. The threat actor also used a previously unknown elevation of privilege (EoP) exploit and a POS memory scraping tool, PUNCHTRACK, to scrape payment card data