Hawkeye is exploiting an 18-year-old vulnerability in Microsoft Office products using malicious office documents. The HawkEye malware kit and information-stealer has been spotted in a newfound slew of campaigns after a recent ownership change. It comes with special key-logging abilities and anti-detection features. The exploited flaw was discovered and manually fixed by Microsoft in 2017.
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka “Microsoft Office Memory Corruption Vulnerability”.
The threat group uses NirSoft utilities to collect credentials. The recent Rattlesnake attack on Pakistan Navy also exploited this vulnerability, indicating that users are still running unpatched versions of the affected products. The vulnerability was also exploited by the Cobalt hackers last year.