Rewterz Threat Alert – Home and Small Office Wireless Routers Exploited to Attack Gaming Servers
November 1, 2019Rewterz Threat Alert – Fake Voicemail/Office 365 Attack Targets Enterprise Execs
November 1, 2019Rewterz Threat Alert – Home and Small Office Wireless Routers Exploited to Attack Gaming Servers
November 1, 2019Rewterz Threat Alert – Fake Voicemail/Office 365 Attack Targets Enterprise Execs
November 1, 2019Severity
Medium
Analysis Summary
Attackers have targeted precision companies in Italy with phishing that is difficult to spot. The final payload is a fileless trojan that harvests credentials. The campaign used a legitimate-looking Microsoft Excel spreadsheet embedded with exploit code that moves silently to infect the computer.
The cybercriminals made all efforts to craft an email the victim company would typically receive from a customer. From body to sender’s address and the document attached, everything was spot on.
The spearphishing email was sent on October 26 to individuals in the sales department of the precision company. It had attached an Excel spreadsheet containing a list of spare parts identified with real catalog codes, quantities, and shipping addresses.
The exploit
Unlike the run-of-the-mill methods of infection that involve a Microsoft Office document, the cybercriminals behind this campaign did not embed malicious macro code in the Excel file, which would call for user interaction.
Instead, they opted for a stealthier variant, an exploit for a remote code execution security bug that would run automatically run code on the victim computer without user intervention as soon as the document was opened.
The vulnerability is an old one (CVE-2017-11882) in the Equation Editor component of Microsoft Office software, responsible for inserting or editing OLE objects in documents. It was fixed two years ago in Microsoft Office software but exploits are publicly available along with code to generate them.
Impact
Exposure of sensitive information
Indicators of Compromise
From Email
steel@vardhman.com
SH256
- 863934c1fa4378799ed0c3e353603ba0bee3a357a5c63d845fe0d7f4ebc1a64c
- 64114c398f1c14d4e840f62395edd9a8c43d834708f8d8fce12f8a6502b0e981
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments by unknown senders.