[sunjester]

The document exploits CVE-2017-0199, an arbitrary code execution vulnerability in Office. The file also attempts to perform some geo-location lookups and contacts the command and control (C&C) server to receive a JavaScript script responsible for downloading the final payload.

https://www.securityweek.com/new-luckyca...sers-tibet

[darkninja1980]

the article looks very interesting to read.

[Johnngnky]

Users(including me) need to be more aware of macro enabled documents.

[mothered]

a JavaScript script responsible for downloading the final payload

Why am I not surprised that JavaScript Is part of the equation?