sb-nz logo
Story image

Attackers exploit macro-less Office documents to create havoc

03 Apr 2018

Cybercriminals use Microsoft Office documents to conduct ‘macro-less’ attacks that dodge organisations’ defences and inject malware – a technique that has been named a top threat in WatchGuard Technologies’ Q4 2017 Internet Security Report.

The report says that Dynamic Data Exchange (DDE) attacks are now on WatchGuard’s top 10 malware list, as hackers increasingly exploited issues within the Microsoft Office standard to execute code.

The DDE protocol is used to transfer data between applications – for example, Word may use the protocol to keep a table created in Excel up to date by automatically updating the information between the two programs, the report explains.

DDE attacks are also known as ‘macro-less’ malware. The attacks are able to use PowerShell and hidden scripts to dodge network defences.

Criminals have been quick to put these exploits into practice – two of the top 10 network attacks in Q4 involved Microsoft Office exploits.

The first top 10 network attack is a memory corruption vulnerability in Microsoft Office (CVE-2015-1650), which allows attackers to execute malicious code to install malware.

The second memory corruption vulnerability (CVE-2016-7231) is a similar attack that goes after Excel document.

“However, though the flaw lies in Excel, attackers can apparently exploit it using almost any type of Office document, including Word documents, Excel spreadsheets, or even PowerPoint presentations. Basically, if an attacker tricks you into opening a maliciously crafted Office document, they could exploit this to install malware on your system, with your privileges,” the report says.

Trojan.Downloader.DDE.Gen also uses Office documents and DDE threats in email campaigns. In one case, the Trojan delivered the Locky ransomware through a fake invoice document.

Malicious Office documents generally targeted Germany, China and the United States, and there was a large increase in malicious documents during Q4, the report notes.

“Although these criminal tactics may vary over time, we can be certain that this broad trend will persist, so the risks have never been greater for small and midsize organisations with less IT and security resources,” comments WatchGuard Technologies chief technology officer Cory Nachreiner.

Beyond the world of DDE threats, malware attacks grew significantly across the world. WatchGuard Fireboxes blocked more than 30 million malware variants in Q4 – a 33% increase over Q3. Zero-day malware threats grew most and accounted for 46% of all malware in Q4.

Cybercriminals are looking to EMEA as a lucrative target as the region accounted for 45.5% of the top malware attacks; followed by the Americas (40.5%) and Asia Pacific (14.1%).

The report says that malware attacks in Asia Pacific were relatively high compared to previous quarters, with Windows malware Win32/Heur taking out the top malware spot in the region.

“We encourage businesses of all sizes to proactively mitigate these threats with layered security services, advanced malware protection, and employee education and training in security best practices,” Nachreiner concludes.

Story image
Why best-practice threat data management provides confident automation
Understanding an organisation’s threat landscape requires having both the right threat data sources and the proper prioritisation to derive actionable threat intelligence for your organisation. More
Story image
Research: Younger cybersecurity pros more fearful of being replaced by AI
According to the findings, 53% of respondents under 45 years old either agreed or strongly agreed that AI and ML are a threat to their job security, despite 89% of this demographic believing that it would improve their jobs.More
Story image
COVID-19 crushes fingerprint reader market
However, the biometrics market is expected to regain momentum with alternatives already beginning to find their feet.More
Story image
Interview: How cyber hygiene supports security culture - ThreatQuotient
We spoke with ThreatQuotient’s APJC regional director Anthony Stitt to dig deeper into cyber hygiene, security culture, threat intelligence, and the tools that support them.More
Story image
Gartner reveals the top strategic tech trends for 2021
“CIOs are striving to adapt to changing conditions to compose the future business - this requires the organisational plasticity to form and reform dynamically. Gartner’s top strategic technology trends for 2021 enable that plasticity.”More
Story image
Lumen launches managed security services for APAC market
The new service is designed to provide enterprise businesses with a proactive, connected security strategy to enhance threat detection and protection across endpoints. More