AeroBlade

Executive Summary

AeroBlade is an emerging threat actor conducting sustained cyber espionage campaigns targeting the aerospace sector in the United States. The group employs spear-phishing attacks using weaponized Office documents with malicious VBA macros and remote template injection techniques. Since September 2022, the actor has executed a multi-phase attack chain against a major aerospace organization, though its origin and ultimate objectives remain unattributed.

Goals & Targeting

AeroBlade's strategic objectives appear to center on industrial espionage, targeting the aerospace sector due to its concentration of cutting-edge technology and defense-related intellectual property. The United States is a key focus given its leadership in aerospace innovation, suggesting the actor seeks to exfiltrate trade secrets, technological blueprints, or strategic business intelligence to benefit a competing nation or private entity. The absence of overt ransomware or financial extortion tactics points toward a focused espionage campaign rather than financial gain. Typical victims include aerospace manufacturers, defense contractors, and research institutions involved in advanced materials, propulsion systems, or satellite technologies.

AeroBlade represents a previously unidentified threat actor engaged in commercial and competitive cyber espionage. The group's operations have focused on targeting an aerospace organization in the United States, where they have leveraged spear-phishing as the primary initial access vector. Attackers embed malicious VBA macro code and employ remote template injection techniques within weaponized Microsoft Office documents to compromise victims. Multiple phases of the attack chain have been observed since September 2022, indicating a structured and persistent operation. Technical analysis suggests the group has developed a layered approach to infiltration, though their operational infrastructure and command-and-control mechanisms remain unclear. The lack of attribution and limited visibility into the actor's broader network of compromised systems pose significant challenges for threat hunting and detection.

Key Capabilities

• Spear-phishing campaigns with weaponized Microsoft Office documents
• Remote template injection exploits in Office files
• Malicious VBA macro code execution
• Multi-phase attack chain execution
• Targeted initial access via social engineering
• Document-based payload delivery techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

AeroBlade has maintained a persistent presence since September 2022, conducting a multi-phase campaign against U.S. aerospace targets. The attacks demonstrate a high degree of operational patience, with initial spear-phishing attempts followed by lateral movement and data exfiltration phases. The actor's focus on the aerospace sector suggests a long-term campaign to harvest sensitive research and development data. Notable operational patterns include the use of document-based payloads and the absence of known affiliations with state-sponsored groups or organized cybercrime networks.

IOC Patterns

• Spear-phishing emails with malicious Microsoft Office attachments
• Remote template injection in Office documents
• VBA macro code with obfuscation and persistence mechanisms
• Multi-stage payload delivery over email
• Unusual document metadata indicators

Recommended Actions

• Implement advanced email filtering with attachment sandboxing for office documents
• Enforce strict macro execution policies and user training on phishing indicators
• Deploy endpoint detection and response (EDR) solutions to monitor VBA macro activity
• Conduct regular red team exercises targeting document-based attack vectors
• Monitor for anomalous document creation times and metadata inconsistencies

Suggested Tags