How can “Excel macro” be still an attack vector after is issue has been known for 23 years? Or malicious email attachment?
> Below are the five unique entry vectors observed thus far in 2021.
- A user downloads a malicious email attachment that, when opened, initiates a payload that downloads and installs a QakBot variant of malware. In at least one case, the version of QakBot we observed collected emails stored on the local system, archived them and exfiltrated them to an attacker controlled server.
- In one instance, a malicious ZIP file attachment containing a macro-embedded Excel file that led to an Ursnif infection was used to initially compromise the victim network.
Several actors utilized compromised credentials to access internet-facing systems via RDP. It’s unclear how the actors gained access to the credentials in these instances.
- An actor exploited a vulnerability in a client SonicWall appliance categorized as CVE-2021-20016 to gain access to credentials needed to access the environment.
- An actor utilized the Exchange CVE-2021-27065 and CVE-2021-26855 vulnerabilities to gain access to an internet-facing Exchange server, which ultimately allowed the actor to create a local administrator account named “admin” that was added to the “Remote Desktop Users” group.
* User has an important problem
* Central IT will not oblige for whatever good or bad reason
* User is both required and forbidden to resolve the problem, decides Central IT can stuff it, and writes a powerfull excel macro.
* Other have the same pain, so User's macro gets copied, cloned, weirdly mutated etc...
* At some point data has to be exchanged with another company, so they semi accidentally get the macro too. This introduces a required potentially malicious email atachment.
* In all of this, everybody conspires to get Central IT out of it, as they will stop the macro and cause much pain and delay for everyone involved. In a lot of cases, Central IT does its utmost best to not officially notice the macro.
This is generally good, as it allows big corporations to survive, even in spite of Central IT. But it also means things like this attack easily happen.
Almost every organisation with more than about 150 people will over time devolve to some kind of soviet state with all kinds of institutionalized insanity. As long as humanity has not solved that sociological problem, this attack is the kind of fallout to expect.
Well, a lot of times it's not that Central IT won't oblige, it's more that the business
1. The busines doesn't want to spend money on procuring or developing a reasonable solution
2. They prefer the organic growth pattern by having a non-IT asset run development instead of having to do the long arduous task of requirements gathering and all the political battles involved.
Hah yes we did this at the last company I worked for to categorize shipping info from our freight company’s api to an excel spreadsheet. Mostly did it because we didn’t want to check email all the time and IT did not want to give us a vps to run it on.
> Below are the five unique entry vectors observed thus far in 2021.
- A user downloads a malicious email attachment that, when opened, initiates a payload that downloads and installs a QakBot variant of malware. In at least one case, the version of QakBot we observed collected emails stored on the local system, archived them and exfiltrated them to an attacker controlled server.
- In one instance, a malicious ZIP file attachment containing a macro-embedded Excel file that led to an Ursnif infection was used to initially compromise the victim network. Several actors utilized compromised credentials to access internet-facing systems via RDP. It’s unclear how the actors gained access to the credentials in these instances.
- An actor exploited a vulnerability in a client SonicWall appliance categorized as CVE-2021-20016 to gain access to credentials needed to access the environment.
- An actor utilized the Exchange CVE-2021-27065 and CVE-2021-26855 vulnerabilities to gain access to an internet-facing Exchange server, which ultimately allowed the actor to create a local administrator account named “admin” that was added to the “Remote Desktop Users” group.