Hackers have devised a new strategy to distribute XLoader, a form of information-stealing malware, by sending fraudulent emails that mimic purchase orders. These emails contain Word documents designed to trick recipients into initiating a chain of events that ultimately results in malware installation.
Exploiting Microsoft Vulnerabilities
The attack utilizes an embedded document within the Word file, exploiting a known vulnerability in the Microsoft Equation Editor to deliver its payload. This strategy capitalizes on an everyday business workflow, where recipients are asked to verify order details such as prices and quantities, thus encouraging them to open the document.
In this instance, the exploit involves a DOCX file concealing further stages of the attack. By leveraging familiar business language, the attackers increase the likelihood of their target opening the attachment without suspicion. ASEC researchers have identified and analyzed this phishing campaign, detailing the infection process in a recent report.
Complex Infection Chain
The technical breakdown reveals that once the Word document is opened, it initiates a series of scripts that lead to registry-based persistence and an encrypted payload running in memory. The final payload is identified as XLoader, specifically version 8.9. This malware is capable of stealing browser data and potentially downloading additional malicious software.
The email samples present plausible order details, such as a transaction worth $144,744.50, urging recipients to confirm or dispute any discrepancies. This tactic serves to distract from the document’s malicious intent by focusing on the transaction.
Defense Strategies and Recommendations
For effective defense, organizations are advised to verify unexpected purchase orders directly with known contacts and ensure their Office software is up-to-date. Monitoring should correlate suspicious document activity, script execution, and registry changes to detect potential threats. ASEC suggests carefully inspecting sender domains and attachments as part of a broader security strategy.
The report also highlights the importance of understanding the transition from document to script activity and maintaining logon persistence as investigation points. By integrating threat intelligence, security operations centers can better protect against these evolving threats.
Indicators of compromise, such as specific MD5 hashes and URLs, have been published to aid in detection and prevention efforts. Organizations are urged to remain vigilant and informed about these tactics to safeguard their systems.
