1354
“ First , because the malware is disguised as an unassuming Office document , threat actors can often use this technique to bypass the IT department ’s sandbox environments , detection software or analysis tools that help identify malicious documents , attachments and links , ” Belani said .
 ( phishing: is disguised as,  an unassuming Office document: trusted entity, the malware: tool, threat actors: attacker, bypass the IT department ’s sandbox environments: purpose) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( phishing: is disguised as,  an unassuming Office document: trusted entity, the malware: tool, threat actors: attacker, bypass the IT department ’s sandbox environments: purpose) 