### Overview
Following the initial access achieved through a weaponized Word document, further investigation has revealed the execution of an embedded VBScript backdoor. This backdoor is activated as soon as the document is opened by the target, exploiting vulnerabilities in VBScript execution.

### Technical Details
The VBScript is designed to run in the background, establishing persistent access to the compromised system. It leverages Windows Management Instrumentation (WMI) to execute commands and maintain a foothold.

### Indicators of Compromise (IOCs)
- Unusual network traffic originating from the affected host.
- Creation of scheduled tasks or registry entries linked to VBScript execution.

### Recommendations
- Implement strict email filtering to block potentially malicious attachments.
- Educate personnel on recognizing phishing attempts and suspicious document behaviors.