A threat actor used a phishing email to deliver a file with an embedded macro.

After a remote code execution attack, it is crucial to determine which systems were involved in the incident and to deploy any available patches to those systems. This step is part of the recovery stage, where the focus is on restoring the integrity of the systems and preventing the same vulnerability from being exploited again. Patching the systems helps to close the security gaps that the threat actor exploited and is a key measure in the process of recovering from such an attack