Two days in a row there is a mailing of letters with the .docm extension, has anyone come across this?

Question

Malware

The mailing of such letters goes on behalf of some mail group, users who are members of a particular mail group, how to deal with this? The first thing that came to my mind was to check the users who have the rights to send letters on behalf of the group, what other measures can be taken?

Answer 1

Open the source text of the letter, see the Received headers. You can trace the entire route of the letter in reverse order.

Answer 2

It is also worth noting that this is a file with macros. Those. if you accidentally allow macros to run in Word, a Trojan will be downloaded. This is a classic technique, most likely it is a spam company for installing another locker.