APT Hackers Turn to Malicious Excel Add-ins (.XLL) as Initial Intrusion Vector

guest · Jan 4, 2023

By Ravie Lakshmanan - December 20, 2022

Microsoft's decision to block Visual Basic for Applications (VBA) macros by default for Office files downloaded from the internet has led many threat actors to improvise their attack chains in recent months.

Now according to Cisco Talos, advanced persistent threat (APT) actors and commodity malware families alike are increasingly using Excel add-in (.XLL) files as an initial intrusion vector.
Click to expand...

Weaponized Office documents delivered via spear-phishing emails and other social engineering attacks have remained one of the widely used entry points for criminal groups looking to execute malicious code.

One such method turns out to be XLL files, which is described by Microsoft as a "type of dynamic link library (DLL) file that can only be opened by Excel."

"XLL files can be sent by email, and even with the usual anti-malware scanning measures, users may be able to open them not knowing that they may contain malicious code," Cisco Talos researcher Vanja Svajcer said in an analysis published last week.
Click to expand...

That said, the first publicly documented malicious use of XLL is said to have occurred in 2017 when the China-linked APT10 (aka Stone Panda) actor utilized the technique to inject its backdoor payload into memory via process hollowing.
Click to expand...

Malicious Microsoft Publisher macros push Ekipa RAT
Ekipa RAT, besides incorporating XLL Excel add-ins, has also received an update in November 2022 that allows it to take advantage of Microsoft Publisher macros to drop the remote access trojan and steal sensitive information.

"Just as with other Microsoft office products, like Excel or Word, Publisher files can contain macros that will execute upon the opening or closing [of] the file, which makes them interesting initial attack vectors from the threat actor's point of view," Trustwave noted.
"The creators of this malware are tracking changes in the security industry, like blocking macros from the internet by Microsoft, and shifting their tactics accordingly."
Click to expand...

Cisco Talos: Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins

By Vanja Svajcer - December 20, 2022

Microsoft is phasing out support for executing VBA macros in downloaded Office documents.

Cisco Talos investigates another vector for introduction of malicious code to Microsoft Excel—malicious add-ins, specifically XLL files.

Although XLL files were supported since early versions of Excel, including Excel 97, malicious actors started using it relatively recently.

Currently, a significant number of advanced persistent threat actors and commodity malware families are using XLLs as an infection vector and this number continues to grow.

Click to expand...

EASTER · Jan 5, 2023

There's no shortages of entry ways.

guest · Jan 23, 2023

Microsoft plans to kill malware delivery via Excel XLL add-ins
By Sergiu Gatlan @serghei - January 23, 2023

Microsoft is working on adding XLL add-in protection for Microsoft 365 customers by including automated blocking of all such files downloaded from the Internet.
Click to expand...

This will help tackle the rise of malware campaigns abusing this infection vector to an ever-growing extent during the last several years.

"In order to combat the increasing number of malware attacks in recent months, we are implementing measures that will block XLL add-ins coming from the internet," Redmond says.
Microsoft says the new feature will reach general availability in multi-tenants worldwide in March for desktop users in the Current, Monthly Enterprise, and Semi-Annual Enterprise channels.
Click to expand...

Attackers are using XLL add-ins in phishing campaigns to push various malicious payloads in the form of download links or attachments camouflaged as documents from trusted entities such as business partners or as fake advertising requests, holiday gift guides, and website promotions.

As XLL files are executables and attackers can use them to run malicious code on your computer, you must only open one if you're 100% sure it comes from a trusted source.
Click to expand...

As Cisco Talos said in a January report, XLLs are now used by both financially-motivated attackers and state-backed threat groups (APT10 , FIN7, Donot, TA410) as an infection vector to deliver first-stage payloads onto their targets' devices.

"Even if XLL add-ins existed for some time, we were not able to detect their usage by malicious actors until mid-2017 when some APT groups started using them to implement a fully functional backdoor," Cisco Talos said.
"We also identified that their usage significantly increased over the last two years as more commodity malware families adopted XLLs as their infection vector."
Click to expand...

Log in or Sign up

APT Hackers Turn to Malicious Excel Add-ins (.XLL) as Initial Intrusion Vector

guest Guest

EASTER Registered Member

guest Guest

Log in or Sign up

APT Hackers Turn to Malicious Excel Add-ins (.XLL) as Initial Intrusion Vector

guest Guest

EASTER Registered Member

guest Guest

Useful Searches