APT28 deploys NotDoor Outlook backdoor via OneDrive DLL side-loading, enabling email-based data theft in NATO firms.

This is achieved in three steps via the VBA shell function: Launches cmd.exe passing the /c parameter - carries out the command and exits Constructs a batch file named 'alpaca.bat' ...