In a campaign targeting thousands of Korean businesses, we found an .ISO attachment — used as the malicious downloader — disguised as a confirmed flight ticket from a popular airline.  Figure 8. TA505 spoofing an airline company as a malicious file attachment.