Daily Summary
Formbook activity nearly doubled today with 100 new samples collected against a 7-day average of 52, a 92% increase. This marks the highest single-day volume in the current tracking window and represents a clear departure from the steady baseline of the past week. No new C2 servers were identified, suggesting the surge reflects increased distribution rather than new infrastructure buildout.
New Samples Detected
The file type distribution is heavily skewed toward script-based delivery: 71 .js files (71% of the day’s total), followed by 13 .ps1, 5 .exe, and 3 each of .wsf and .vbs. Rounding out the count are 2 .rar archives and three samples with non-standard numeric extensions (.21885, .26668, .13296), which typically indicate either corrupted PE headers or packer artifacts masking the true format. The dominance of .js over executable payloads is the key signal here. Formbook has historically been delivered as Office macros or packed executables; a shift toward JavaScript as the primary loader format suggests the operators are adapting to macro-blocking defaults and favor script hosts (wscript, cscript) for initial execution.
7-Day Trend
Today’s count of 100 sits 92% above the 52-sample average and is roughly double the volume seen on any single day in the prior week. The jump is abrupt rather than gradual, which points to a discrete campaign push rather than organic drift. Worth monitoring tomorrow: if volume returns to baseline, this was a burst; if it holds above 80, the distribution model has changed.
IOC Highlights
All 100 samples generated new IOCs, but with zero new C2 servers, the extracted network indicators likely resolve to a small set of previously known panels. Analysts should prioritize the file hashes and script metadata over network IOCs today, since the infrastructure side is unchanged. The three numeric-extension samples deserve manual triage given their ambiguous format.
Security Analysis
The pivot toward .js loaders aligns with a pattern seen in recent Formbook distribution waves that abuse commodity phishing kits and fake document portals to serve script files directly, bypassing macro restrictions entirely. The absence of new C2 despite doubled volume suggests the operators are reusing established panels and focusing effort on delivery capacity, not infrastructure expansion. Actionable recommendation: enable script host logging (Windows Script Host event ID 1) and block .js/.wsf attachments at the mail gateway, since email remains the most probable vector for this delivery profile. SOC teams should also hunt for wscript.exe spawning child processes, a reliable behavioral signal for this loader style.