A new, unique JavaScript payload is now being used by Turla in targeted attacks. This new payload, dubbed KopiLuwak, is being delivered using embedded macros within Office documents.
Article Link: http://cyberparse.co.uk/2017/02/02/kopiluwak-a-new-javascript-payload-from-turla/