Cybercriminals are infiltrating our Microsoft Excel spreadsheets now
Lightweight RAT is distributed by Excel, researchers claim
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Experts have uncovered a new cybercrime campaign abusing Excelspreadsheetsto distribute nasty trojanmalware.
Cybersecurity researchers from Morphisec Labs have spotted the Russian threat actor, FIN7 (aka Carbanak), distributing a small, lightweight Remote Access Trojan (RAT), a variant of JSSLoader, through mailed XLL and XLM files.
These files carry weaponized add-ins, which allow the attackers to exfiltrate data, establish persistence on the targetendpoint, and have the RAT perform auto-updates, among other things.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Flying under the radar
This particular RAT has been around since December 2020. In this campaign, though, the attackers are trying to distribute an unsigned file, meaning Excel will show a clear warning that running the file comes with risks.
The researchers explain that these XLL files, should the victim enable them, use malicious code found in the xlAutoOpen function, load themselves into memory, after which they download the stage-two malware from a remote server.
After that, they use an API call to run the process.
Even though it has the same execution flow, this JSSLoader variant is a bit different from the older ones, as it is capable of renaming all functions and variables, in a bid to stay below the radar of antivirus and other security solutions.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
It also splits the strings into sub-strings and chains them at runtime, to further avoid being detected by string-based YARA rules.
The tyranny of Microsoft Excel may finally be over>Beware - that Windows 11 document is probably a scam>Adapting defenses to stop attacks and breaches
These new detection-avoiding methods, together with the way the payload is delivered, are enough for the RAT to remain out of sight of most antivirus and endpoint protection solutions, Morphisec added.
FIN7 can use it for unabated lateral movement throughout the compromised network, for days, or even weeks, before being spotted, the company said.
The threat actor is a relatively creative criminal group, which recently made headlines in January 2022 when it was found to bemailing malicious thumb drivesto victims.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
I’ve been a Firefox power user since it launched 20 years ago – here’s why it still beats Chrome and Safari
