Tommy M (TheAnalyst) on Twitter: "Speaking of which, today we see #IcedID via the same #OneNote template that #qbot actors #TA570 & #TA577 has been using the last few days. New obfuscation in the HTA though. https://t.co/tlid382wIN" / Twitter

https://twitter.com/ffforward/status/1621195397250289664

https://twitter.com/home/status/1622426990400913408

https://twitter.com/home/status/1622438958327021568

https://twitter.com/home/status/1622532051361464320

https://twitter.com/home/status/1622575647540518916

https://twitter.com/home/status/1622578360206430208

https://twitter.com/home/status/1622634537183240193

https://twitter.com/home/status/1622657081403916288

https://twitter.com/home/status/1622675965250764800

https://twitter.com/home/status/1622679095124561920