The most common malicious email attachments infecting Windows

guest · Oct 11, 2020

The most common malicious email attachments infecting Windows
October 11, 2020
https://www.bleepingcomputer.com/ne...alicious-email-attachments-infecting-windows/

To stay safe online, everyone needs to recognize malicious attachments that are commonly used in phishing emails to distribute malware.

When distributing malware, threat actors create spam campaigns that pretend to be invoices, invites, payment information, shipping information, eFaxes, voicemails, and more. Included in these emails are malicious Word and Excel attachments, or links to them, that when opened and macros are enabled, will install malware on a computer.
Click to expand...

To trick users into clicking these buttons, the malware distributors create Word and Excel documents that contain text and images stating that there is an issue displaying the document. It then prompts recipients to click 'Enable Content' or 'Enable Editing' to see the contents correctly.
The combination of text and images in these malicious attachments are called 'document templates.'

Below are different document templates that have been used in the spam campaigns for some of the more wide-spread malware infections.
Click to expand...

BazarLoader
BazarLoader is an enterprise-targeting malware developed by the same group behind the TrickBot trojan. When installed, threat actors use BazarLoader/BazarBackdoor to remotely access your computer, which is then used to compromise the rest of your network.
Dridex
Dridex is an advanced and modular banking Trojan first spotted in 2014 and is continuously updated.
When infected, Dridex will download different modules that can be used to steal passwords, provide remote access to a computer, or perform other malicious activities.
Emotet
Emotet is the most widely distributed malware through spam emails containing malicious Word or Excel documents. Once infected, Emotet will steal a victim's email and use the infected PC to spew out further spam to recipients worldwide.
QakBot
QakBot, or QBot, is a banking trojan that spreads via phishing campaigns that deliver malicious Microsoft Word documents, usually to businesses.
Click to expand...

All executable attachments
Finally, you should never open attachments that end with the .vbs, .js, .exe, .ps1, .jar, .bat, .com, or .scr extensions as they can all be used to execute commands on a computer.

As most email services, including Office and Gmail, block "executable" attachments, malware distributors will send them in password-protected archives and include the password in the email.
This technique allows the executable attachment to bypass email security gateways and reach the intended recipient.
Click to expand...

guest · Jan 21, 2023

Hackers now use Microsoft OneNote attachments to spread malware
By Lawrence Abrams @LawrenceAbrams - January 21, 2023

Threat actors now use OneNote attachments in phishing emails that infect victims with remote access malware which can be used to install further malware, steal passwords, or even cryptocurrency wallets.
Click to expand...

This comes after attackers have been distributing malware in emails using malicious Word and Excel attachments that launch macros to download and install malware for years.

However, in July, Microsoft finally disabled macros by default in Office documents, making this method unreliable for distributing malware.
Click to expand...

Abusing OneNote attachments
Microsoft OneNote is a desktop digital notebook application that can be downloaded for free and is included in Microsoft Office 2019 and Microsoft 365.

Since mid-December, cybersecurity researchers warned that threat actors had started distributing malicious spam emails containing OneNote attachments.
From samples found by BleepingComputer, these malspam emails pretend to be DHL shipping notifications, invoices, ACH remittance forms, mechanical drawings, and shipping documents.
Click to expand...

Unlike Word and Excel, OneNote does not support macros, which is how threat actors previously launched scripts to install malware.

Instead, OneNote allows users to insert attachments into a NoteBook that, when double-clicked, will launch the attachment.
Threat actors are abusing this feature by attaching malicious VBS attachments that automatically launch the script when double-clicked to download malware from a remote site and install it.
Click to expand...

In malspam emails seen by BleepingComputer, the OneNote files install remote access trojans that include information-stealing functionality.

Cybersecurity researcher James confirmed this, telling BleepingComputer that the OneNote attachments he analyzed installed the AsyncRAT and XWorm remote access trojans.
Click to expand...

guest · Feb 2, 2023

Microsoft OneNote Is Latest Malware Vector
By Prajeet Nair @prajeetspeaks - February 2, 2023

At least somebody uses Microsoft OneNote: Security researchers say they've detected an increase in the number of hackers delivering malware via the note-taking app bundled into the computing giant's Office suite of programs.
Click to expand...

A spike over the last two months in malicious .one files is likely due to hackers adapting to Microsoft's crackdown on macros, leading them to look for other ways to smuggle malware past threat detection, say researchers at Proofpoint.

Attachments initially observed by the company didn't register as malicious with antivirus engines, making it likely that emails appearing in inboxes had a high success rate of infection, the researchers say.
Click to expand...

OneNote-delivered malware still requires users to click through the warning messages Microsoft throws at them when they open attachment files. Multiple threat actors are resorting to OneNote as a threat vector, but Proofpoint says adoption of the tactic by the threat actor it tracks as TA577 is particularly worrying.

"TA577's adoption of OneNote suggests other more sophisticated actors will begin using this technique soon. This is concerning: TA577 is an initial access broker that facilitates follow-on infections for additional malware including ransomware," Proofpoint says.
Click to expand...

Observed OneNote campaigns share similar characteristics. Phishing messages typically contain OneNote file attachments with themes such as "invoice, remittance, shipping" or seasonal themes. Hackers have also sent links to download OneNote files.
The documents contain embedded files "often hidden behind a graphic that looks like a button."

Proofpoint isn’t the only cybersecurity firm to recently observe a shift to OneNote among hackers. Trustwave in December spotted a campaign using OneNote to move Formbook malware.
Click to expand...

Proofpoint: OneNote Documents Increasingly Used to Deliver Malware

By Tommy Madjar, Corsin Camichel, Joe Wise, Selena Larson and Chris Talib - February 1, 2023
Key Findings:
• The use of Microsoft OneNote documents to deliver malware via email is increasing.
• Multiple cybercriminal threat actors are using OneNote documents to deliver malware.
• While some campaigns are targeted at specific industries, most are broadly targeted and include thousands of messages.
• In order to detonate the payload, an end-user must interact with the OneNote document.
• Campaigns have impacted organizations globally, including North America and Europe.
• TA577 returned from a month-long hiatus in activity and began using OneNote to deliver Qbot at the end of January 2023.
Click to expand...

Log in or Sign up

The most common malicious email attachments infecting Windows

guest Guest

guest Guest

guest Guest

Log in or Sign up

The most common malicious email attachments infecting Windows

guest Guest

guest Guest

guest Guest

Useful Searches