DarkHydrus uses the open-source Phishery tool to create two of the known Word documents used in the attacks.
Source: Threadpost