Hackers Change Tactics for New Post-Macro Era

Danger actors are going away from macro-dependent attacks to other ways, in 1 of the most significant shifts in the email threat landscape in new record, in accordance to Proofpoint.

Microsoft declared in October 2021 that it would quickly block XL4 macros which are specific to Excel. Several months afterwards it said the same about VBA macros, which are applied in Business apps. Menace actors commonly use social engineering to convince customers they want to enable macros to check out specific content.

The improvements began to roll out this year, and Proofpoint saw an practically fast response from the cybercrime local community.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

It claimed the use of macro-enabled attachments by danger actors diminished by all over 66% amongst October 2021 and June 2022.

However, ever-resourceful hackers have discovered a way to bypass Microsoft’s new rules to go on offering malicious material to victims.

“Microsoft will block VBA macros primarily based on a Mark of the Web (MOTW) attribute that displays no matter if a file arrives from the internet recognised as the Zone.Identifier. Microsoft applications increase this to some files when they are downloaded from the web,” stated Proofpoint.

“However, MOTW can be bypassed by working with container file formats. Menace actors can use container file formats these as ISO, RAR, ZIP and IMG files to send macro-enabled paperwork.”

The seller defined that downloaded container documents like ISO and RAR will have the MOTW attribute since they were downloaded from the internet, but the document inside, this sort of as a macro-enabled spreadsheet, will not. The moment the doc is extracted, the user will still have to allow macros for destructive code to execute, but the file process will not establish the document as coming from the web.

“Additionally, risk actors can use container information to distribute payloads right. When opened, container information may incorporate extra information these types of as LNKs, DLLs, or executable data files that lead to the set up of a destructive payload,” Proofpoint added.

As a end result, the security vendor has noticed the number of malicious strategies employing container file formats surge 176% amongst October 2021 and June 2022.

These attacks are predominantly employed for initial accessibility, Proofpoint mentioned.

“Proofpoint researchers assess with superior confidence this is 1 of the most significant email danger landscape shifts in the latest heritage,” it concluded. “It is most likely threat actors will continue to use container file formats to produce malware, when relying considerably less on macro-enabled attachments.”