deltaww — Vulnerabilities & Security Advisories 26

Deltaww primarily targets enterprise environments through phishing campaigns, delivering malware for data theft and espionage. Historically, it exploits RCE vulnerabilities in Microsoft Office and Adobe products, along with XSS flaws in web applications, and privilege escalation techniques to maintain persistence. The group demonstrates sophisticated tradecraft, including custom loaders and living-off-the-land tactics. Notable characteristics include its use of compromised email accounts for lateral movement and its focus on high-value targets in government and defense sectors. Deltaww has been linked to several major incidents, including the exploitation of zero-day vulnerabilities in widely used software, resulting in significant data breaches across multiple organizations.