The attacks that FireEye observed in the wild leveraged a Rich Text Format (RTF) document, similar to the CVE2017-0199 documents we previously reported on. The malicious sampled contained an embedded SOAP monikers