Any humanitarian organization who works directly with US Aid, as well as those who are connected indirectly through another program - need to be cautious with email links as well as scan for current compromised networks.

Microsoft announced a sophisticated and widespread attack that sent 3,000 malicious links to 150 organizations. And the threat is still active.

For Microsoft Windows Users, apply these mitigations to reduce the impact of this threat. Check the recommendations on Microsoft for the deployment status of monitored mitigations.

1. Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a huge majority of new and unknown variants.
2. Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the threat or when Microsoft Defender Antivirus is running in passive mode. (EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.)
3. Enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the internet.
4. Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.
5. Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them to Microsoft Defender for Endpoint.
6. Enable multifactor authentication (MFA) to mitigate compromised credentials. Microsoft strongly encourages all customers download and use passwordless solutions like Microsoft Authenticator to secure your accounts.
7. For Office 365 users, see multifactor authentication support.
8. For Consumer and Personal email accounts, see how to use two-step verification.
9. Turn on the following attack surface reduction rule to block or audit activity associated with this threat: Block all Office applications from creating child processes. NOTE: Assess rule impact before deployment.

Microsoft Defender Antivirus detects threat components as the following malware:

Trojan:Win32/NativeZone.C!dha