Risk actors are seemingly using a instrument designated for crimson teaming workout routines to serve malware, in accordance with new findings from Cisco Talos.
This system in query is a payload technology framework referred to as MacroPack, which is used to generate Workplace paperwork, Visible Primary scripts, Home windows shortcuts, and different codecs for penetration testing and social engineering assessments. It was developed by French developer Emeric Nasi.
The cybersecurity firm stated it discovered artifacts uploaded to VirusTotal from China, Pakistan, Russia, and the U.S. that have been all generated by MacroPack and used to ship varied payloads comparable to Havoc, Brute Ratel, and a brand new variant of PhantomCore, a distant entry trojan (RAT) attributed to a hacktivist group named Head Mare.
“A common feature in all the malicious documents we dissected that caught our attention is the existence of four non-malicious VBA subroutines,” Talos researcher Vanja Svajcer stated.
“These subroutines appeared in all the samples and were not obfuscated. They also had never been used by any other malicious subroutines or anywhere else in any documents.”
An essential facet to notice right here is that the lure themes spanning these paperwork are assorted, starting from generic subjects that instruct customers to allow macros to official-looking paperwork that seem to return from army organizations. This means the involvement of distinct risk actors.
A few of the paperwork have additionally been noticed benefiting from superior options supplied as a part of MacroPack to bypass anti-malware heuristic detections by concealing the malicious performance utilizing Markov chains to create seemingly significant features and variable names.
The assault chains, noticed between Might and July 2024, comply with a three-step course of that entails sending a booby-trapped Workplace doc containing MacroPack VBA code, which then decodes a next-stage payload to in the end fetch and execute the ultimate malware.
The event is an indication that risk actors are continuously updating techniques in response to disruptions and taking extra refined approaches to code execution.
