Backdoor Uses FTP Server as C&C

Dubbed SYSCON, the malware is being distributed through malicious documents containing macros. All of these documents mention North Korea and appear to be targeted at individuals connected to the Red Cross and the World Health Organization.

Read full news article on SecurityWeek