Like many threat groups, TA558 has quickly adapted to Microsoft’s decision over recent months to disable macros by default in Office products, using container files like RAR and ISO attachments instead of macro-enabled Office docs.