Tommy M (TheAnalyst) on Twitter: "Speaking of which, today we see #IcedID via the same #OneNote template that #qbot actors #TA570 & #TA577 has been using the last few days. New obfuscation in the HTA though. https://t.co/tlid382wIN" / Twitter

https://twitter.com/ffforward/status/1621195397250289664