According to eWeek:

The SANS ISC (Internet Storm Center) said in a diary entry that it received reports of the exploit from an unnamed organization that was targeted. “The e-mail was written to look like an internal e-mail, including signature. It was addressed by name to the intended victim and not detected by the anti-virus software,” said Chris Carboni, an ISC incident handler tracking the attack.

When the .doc attachment is opened, it exploits a previously unknown vulnerability in Microsoft Word and infects a fully patched Windows system. The exploit functioned as a dropper, extracting and launching a Trojan that immediately overwrites the original Word document with a “clean,” uninfected copy.

“As a result of the exploit, Word crashes, informs the user of a problem, and offers to attempt to re-open the file. If the user agrees, the new ‘clean’ file is opened without incident,” the ISC explained.

Microsoft has been notified and is working with security researchers to investigate the bug.

The full story: Microsoft: Use MS Word in Safe Mode can be found here and Alert Raised for MS Word Zero-Day Attack can be found here.

While this attack appears somewhat contained, don’t put your business in jeopardy. Take precautions, update your virus software, adware/spyware software and make sure you utilize a firewall.