Malicious Macros Remain Highly Effective

Microsoft Office documents with malicious macros are still one of the top choices for attackers of all skill levels, according to Craig Williams from Cisco Talos. On the CyberWire’s Research Saturday podcast, Williams explained that Talos has been monitoring a threat actor using a Trojan dubbed “PoetRAT” to target Azerbaijani government departments. The threat actor isn’t particularly sophisticated, but it’s been steadily improving its tradecraft since it was first spotted earlier this year. Even so, it’s continuing to rely on the relatively simple technique of using Word documents with malicious macros to trick users into installing malware.

“If you look at the way that they're crafting the Word documents that they use as the vector for this, they're impersonating official government documentations for the local government,” Williams said. “And we see that a lot. You know, we saw that with campaigns in North Korea, a couple in Russia. So it's a common technique, but it is a way that they can target a specific country, because if they want intelligence on officials in those regions, they're going to use the right letterhead, they're going to use the right context, and so that can give you a much more involved picture of who they're targeting, which then can give you some insight into why they're targeting those people.”

This technique is simple enough for any hacker to use, yet it’s employed by even the most advanced nation-state actors because it works so well.

“Now, there is still the very real fact that they're using a Microsoft Word document with a macro embedded in it,” Williams said. “Which unfortunately is still remarkably successful, right? I mean, this has been around for decades. It's something everyone should know and everyone should have mitigation strategies in place for, but unfortunately, what we can see here is at least this actor believes that his potential targets do not have those strategies in place.”

Williams concluded that even as this threat actor improves its operational security and other skills, it will continue relying on this simple social engineering trick for as long as people continue to fall for it.

“So, you know, you've got to realize that this is the type of thing – Word macros – that are probably the largest threat to most organizations,” he said. “Simplistic, well-known, functional attacks that, you know, yeah, they target the system a little bit, but mostly they target the people. And I would guess that probably right behind this is an email saying, ‘hey, click on this.’”

Whether the threat is crime or espionage, new-school security awareness training can give your organization an essential layer of defense by enabling them to thwart social engineering tactics.

The CyberWire has the story.