A recent keylogger campaign leveraged an old Microsoft Office Equation Editor vulnerability to target user credentials, passwords and clipboard content.

As reported by Quick Heal, threat actors used Rich Text Format (RTF) files — either standalone or embedded in PDF files with DOC extensions — to distribute the Hawkeye keylogger malware.

While the attacks used typical phishing emails to target users and organizations, the campaign opted for a less common path to compromise: the Microsoft Office Equation Editor. The so-called “Hawkeye v8 Reborn” exploit CVE-2017-11882, which triggers a stack buffer overflow in Equation Editor by using an unbounded string of FONT name defined within a FONT record structure. If successful, attackers gain the ability to execute arbitrary code and deliver malware payloads.

Latest Version of Hawkeye Keylogger Brings Additional Capabilities

Obfuscation and evasion are critical to Hawkeye’s success. It starts with the use of Equation Editor: Despite a November 2017 fix from Microsoft, many unpatched versions still exist.

In addition, the Hawkeye keylogger attempts to evade detection by compiling code while executing, and loading its payload in memory rather than writing it to disk. By waiting until the last possible moment to compile code and limiting its attack surface to in-memory infections, Hawkeye makes it difficult for security professionals to identify the threat.

Once the keylogger payload is up and running, threat actors have access to myriad functions, including File Transfer Protocol (FTP) copying, mail credential theft and clipboard capture. The malware also leverages antidebugging with SuppressIldasm and ConfuserEx 1.0, and uses legitimate tools such as MailPassView and BrowserPassView to steal passwords. Furthermore, Hawkeye disables antivirus tools, task manager, command prompt and registry, and the restoration service rstrui.exe is also disrupted to prevent file recovery.

How Security Teams Can Dodge Hawkeye’s Attacks

To avoid Hawkeye keylogger campaigns and similar malspam efforts, organizations should start with patching. It comes down to the Pareto Principle: 20 percent of security issues cause around 80 percent of security problems. In the case of CVE-2017-11882, this means applying Microsoft’s November 2017 fix.

Security experts also recommend implementing multilayered malspam defense, including email filtering, endpoint protection and system hardening. Given the ability of determined attackers to bypass these measures, however, it’s also a good idea to deploy automated incident response (IR) processes capable of analyzing emails, extracting indicators of compromise (IoCs), and updating all filtering devices and services with this information.

Source: Quick Heal, Microsoft