Auto-Update Malware Delivery TTP

TLP AMBER ANNOUNCEMENT: 

Malicious Microsoft Word documents are one of the most prevalent malware delivery mechanisms, and typically use embedded Visual Basic (VBA) macros to download and install malware on a victim’s machine. In late August and September 2017, Wapack Labs observed an uptick in an alternative Word doc based malware delivery method being leveraged in malicious email campaigns. The tactic involves using auto-updating links, instead of macros, to download additional malware payloads. Due to the prevalence of Office-based malware delivery, this new method will likely affect multiple industries, including Red Sky Alliance members. This report provides analysis on related specimens, including common artifacts and observed campaigns, as well as a generic mitigation that detects most variants...READ MORE

Wapack Labs has cataloged and reported malware delivery tactics in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Microsoft Office Hoax Phishing Site

On 27 July 2017, Wapack Labs, using our Cyber Threat Analysis Center (CTAC), discovered a phishing site disguised as a Microsoft Office Sign-in page. The phishing site is designed to trick users into entering their Microsoft related email and passwords. When a user enters their credentials into the malicious site, they are then redirected to the real Microsoft Sign-in page. The differences in the webpages can be seen in...READ MORE

Wapack Labs has cataloged and reported extensively on phishing in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

New Macro Variant

On 06 September 2016, Wapack Labs received incident details involving a macro malware variant, that is researcher aware, and is leveraging a new method of string obfuscation.  Macro based malware, one of the most prevalent malware delivery mechanisms, uses embedded macros in Microsoft Office documents to download and install malware on a victim’s machine.  Over 3,600 additional samples of this variant, using the same obfuscation method, were found on Virus Total.  Artifacts from these files suggest widespread targeting in various industries.

This report includes details on the new macro variant delivery mechanism and infrastructure leveraged in these attacks.

Publication date:                   26 September 2016

Handling requirements:         Traffic light protocol (TLP) AMBER

Actor Type:                            Adversary capabilities have been assessed as Tier 1*

Past Reporting:                       Red Sky Alliance: DOC-3977

Indicators:                https://www.threatrecon.co/search?keyword=New_Macro_Variant,                                  redsky.soltra.com

*Practitioners who rely on others to develop the malicious code, delivery mechanisms, and execution strategy (use known exploits). 

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.