Boeing RFQ Malware Campaign Exploits DOCX, RTF, JS, and Python

Cybersecuritynews

Boeing RFQ Malware Campaign Exploits DOCX, RTF, JS, and Python

First seen 2 Apr 2026, 15:33 UTC • •66.5

Article Content

1 / 3

Browse articles

ThreatCluster •April 3, 2026 at 15:31 UTC

•The NKFZ5966PURCHASE campaign targets procurement teams by impersonating Boeing.
•Attack methods include DOCX, RTF, JS, and Python to deliver Cobalt Strike beacons.
•The campaign employs living-off-the-land techniques and reuses encryption keys for evasion.

A sophisticated malware campaign, tracked as NKFZ5966PURCHASE, is targeting industrial suppliers and procurement teams by impersonating Boeing in procurement emails. The attack utilizes DOCX, RTF, JavaScript, PowerShell, and Python to deliver an in-memory Cobalt Strike beacon through a six-stage process. Victims are lured into opening a malicious Word document disguised as a Request for Quotation from a fake sender named Joyce Malave. This campaign leverages living-off-the-land binaries and reuses encryption keys across samples, enhancing its evasion capabilities. The exact number of affected organizations is currently unknown, but the operation poses a significant threat to supply chain security. As of now, the campaign is active and ongoing, with security professionals urged to remain vigilant.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 190d ago How this analysis works

Timeline

2026-04-02

Gbhackers and Cybersecuritynews publish articles on the malware campaign.

More articles in this cluster (2)

Threat Graph

13 entities, 12 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (7)

Malware
Phishing
T1059.001 - PowerShell
T1059.006 - Python
T1059.007 - JavaScript
T1566.001 - Spearphishing Attachment
T1566 - Phishing

Campaign (3)

Boeing RFQ Malware Campaign
Nkfz5966purchase
RFQ Malware Campaign

Malware (1)

Cobalt Strike

Tool (2)

Python
PowerShell

Relationships

Boeing RFQ Malware Campaign uses Cobalt Strike
Nkfz5966purchase uses Cobalt Strike
RFQ Malware Campaign uses Cobalt Strike
Boeing RFQ Malware Campaign related to Malware
Boeing RFQ Malware Campaign related to Phishing
Boeing RFQ Malware Campaign related to T1059.001 - PowerShell
Boeing RFQ Malware Campaign related to T1059.006 - Python
Boeing RFQ Malware Campaign related to T1059.007 - JavaScript
Boeing RFQ Malware Campaign related to T1566.001 - Spearphishing Attachment
Boeing RFQ Malware Campaign related to T1566 - Phishing
Boeing RFQ Malware Campaign related to Python
Boeing RFQ Malware Campaign related to PowerShell

Following this threat?

Track Cobalt Strike in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

FamousSparrow Deploys SparroWocky Backdoor in Latin America The China-aligned cyberespionage group FamousSparrow has replaced its previous backdoor, SparrowDoor, with a new malware called SparroWocky, targeting governmental organizations in Latin America since August 2025. ESET Research attributes this campaign to a likely response to increased U.S. interests in the region.…

Emerging EDR Killer Tool Targeting Ransomware Groups A new malicious tool, referred to as the EDR killer, is being actively used by at least eight ransomware groups, including Blacksuit and Medusa, to disable endpoint detection and response (EDR) solutions. This tool is believed to be an evolution of the EDRKillShifter developed by RansomHub, which allows ransomware…