Malicious Macros Remain Highly Effective

Malicious Macros Highly EffectiveMicrosoft Office documents with malicious macros are still one of the top choices for attackers of all skill levels, according to Craig Williams from Cisco Talos. On the CyberWire’s Research Saturday podcast, Williams explained that Talos has been monitoring a threat actor using a Trojan dubbed “PoetRAT” to target Azerbaijani government departments. The threat actor isn’t particularly sophisticated, but it’s been steadily improving its tradecraft since it was first spotted earlier this year. Even so, it’s continuing to rely on the relatively simple technique of using Word documents with malicious macros to trick users into installing malware.

“If you look at the way that they're crafting the Word documents that they use as the vector for this, they're impersonating official government documentations for the local government,” Williams said. “And we see that a lot. You know, we saw that with campaigns in North Korea, a couple in Russia. So it's a common technique, but it is a way that they can target a specific country, because if they want intelligence on officials in those regions, they're going to use the right letterhead, they're going to use the right context, and so that can give you a much more involved picture of who they're targeting, which then can give you some insight into why they're targeting those people.”

This technique is simple enough for any hacker to use, yet it’s employed by even the most advanced nation-state actors because it works so well.

“Now, there is still the very real fact that they're using a Microsoft Word document with a macro embedded in it,” Williams said. “Which unfortunately is still remarkably successful, right? I mean, this has been around for decades. It's something everyone should know and everyone should have mitigation strategies in place for, but unfortunately, what we can see here is at least this actor believes that his potential targets do not have those strategies in place.”

Williams concluded that even as this threat actor improves its operational security and other skills, it will continue relying on this simple social engineering trick for as long as people continue to fall for it.

“So, you know, you've got to realize that this is the type of thing – Word macros – that are probably the largest threat to most organizations,” he said. “Simplistic, well-known, functional attacks that, you know, yeah, they target the system a little bit, but mostly they target the people. And I would guess that probably right behind this is an email saying, ‘hey, click on this.’”

Whether the threat is crime or espionage, new-school security awareness training can give your organization an essential layer of defense by enabling them to thwart social engineering tactics.

The CyberWire has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews