Risk actors are doubtless using a device designated for purple teaming workouts to serve malware, based on new findings from Cisco Talos.
This system in query is a payload era framework referred to as MacroPack, which is used to generate Workplace paperwork, Visible Primary scripts, Home windows shortcuts, and different codecs for penetration testing and social engineering assessments. It was developed by French developer Emeric Nasi.
The cybersecurity firm stated it discovered artifacts uploaded to VirusTotal from China, Pakistan, Russia, and the U.S. that have been all generated by MacroPack and used to ship varied payloads reminiscent of Havoc, Brute Ratel, and a brand new variant of PhantomCore, a distant entry trojan (RAT) attributed to a hacktivist group named Head Mare.
“A typical characteristic in all of the malicious paperwork we dissected that caught our consideration is the existence of 4 non-malicious VBA subroutines,” Talos researcher Vanja Svajcer stated.
“These subroutines appeared in all of the samples and weren’t obfuscated. Additionally they had by no means been utilized by some other malicious subroutines or anyplace else in any paperwork.”
An vital side to notice right here is that the lure themes spanning these paperwork are assorted, starting from generic matters that instruct customers to allow macros to official-looking paperwork that seem to come back from army organizations. This implies the involvement of distinct risk actors.
A number of the paperwork have additionally been noticed benefiting from superior options supplied as a part of MacroPack to bypass anti-malware heuristic detections by concealing the malicious performance utilizing Markov chains to create seemingly significant capabilities and variable names.
The assault chains, noticed between Might and July 2024, comply with a three-step course of that entails sending a booby-trapped Workplace doc containing MacroPack VBA code, which then decodes a next-stage payload to finally fetch and execute the ultimate malware.
The event is an indication that risk actors are consistently updating ways in response to disruptions and taking extra refined approaches to code execution.
