Article Content Recently, a mass stabbing incident in Kunming, China left 29 victims dead We came across an email which used this incident as social engineering bait To appear legitimate, the message talks about the incident at length and cites several news outlets as its sources It encourages the user to open the attached document for more information The document is entitled “Violent terror attack,” probably named as such to pique the recipient’s interest Figure 1 Spammed message The attached document is actually malicious, and is detected as TROJ_EXPLOYT.AGH This malware takes advantage of a particular Microsoft Office vulnerability (CVE-2012-0158, or MS12-027) to drop a backdoor – BKDR_GHOST.LRK –  onto the system A closer look into BKDR_GHOST.LRK reveals one striking detail: when it communicates to its C&C server, the malware uses the string “LURK0” This string was also associated with a malware variant that was used in the GhostNet campaign We noted in a previous paper titled Detecting APT Activity with Network Traffic Analysis that a Ghost variant had replaced “Gh0st” (its usual header content) with “LURK0” The configuration file also contains the marker “default.” This is often used as a mark on which campaign a malware belongs to However, Trend Micro researchers have encountered old samples bearing the same markers dating back to 2012 Despite its intended target, regular users can still find themselves victims of this attack They should also visit reputable and trustworthy news sites for updates on the latest news and current events. We detect and block all threats related to this incident For more details on various targeted attacks, as well as best practices for enterprises, you may visit our Threat Intelligence Resources on Targeted Attacks Additional analysis by Mark Manahan 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Recently, a mass stabbing incident in Kunming, China left 29 victims dead We came across an email which used this incident as social engineering bait To appear legitimate, the message talks about the incident at length and cites several news outlets as its sources It encourages the user to open the attached document for more information The document is entitled “Violent terror attack,” probably named as such to pique the recipient’s interest Figure 1 Spammed message The attached document is actually malicious, and is detected as TROJ_EXPLOYT.AGH This malware takes advantage of a particular Microsoft Office vulnerability (CVE-2012-0158, or MS12-027) to drop a backdoor – BKDR_GHOST.LRK –  onto the system A closer look into BKDR_GHOST.LRK reveals one striking detail: when it communicates to its C&C server, the malware uses the string “LURK0” This string was also associated with a malware variant that was used in the GhostNet campaign We noted in a previous paper titled Detecting APT Activity with Network Traffic Analysis that a Ghost variant had replaced “Gh0st” (its usual header content) with “LURK0” The configuration file also contains the marker “default.” This is often used as a mark on which campaign a malware belongs to However, Trend Micro researchers have encountered old samples bearing the same markers dating back to 2012 Despite its intended target, regular users can still find themselves victims of this attack They should also visit reputable and trustworthy news sites for updates on the latest news and current events. We detect and block all threats related to this incident For more details on various targeted attacks, as well as best practices for enterprises, you may visit our Threat Intelligence Resources on Targeted Attacks Additional analysis by Mark Manahan  ### Response: .