Using Microsoft Word macros as a vector for the propagation of malware has been mined by many cybercriminals in the past. But there has been an effort lately to take this vector to another level, CSO Online reported. What’s new is that the macros allow fileless malware to load onto a machine’s memory.

Phishing Emails, Macros and More

Palo Alto Networks found about 1,500 phishing emails being used in a campaign it called PowerSniff. These emails were crafted with more personally relevant information than is usually seen in such spam attempts.

Phishers usually included information designed to engender a feeling of trust, perhaps by offering something like a fellow worker’s location. The emails were all developed with social engineering techniques that focused on encouraging the recipient to click on the poisoned link.

Once the attachment was opened, the embedded macro would create a hidden instance of powershell.exe that contained special command-line arguments. Since PowerShell has its own scripting language, commands formed in that language will be executed.

Fileless Malware at Work

First, the malware sees if the machine is running a 32- or 64-bit Windows OS version using the result of a check against the size of the IntPtr object type. The malware payload that corresponds to the configuration of the target machine is then downloaded.

Here comes the new part of the technique: The malware powershell.exe goes on to stuff the downloaded PowerShell commands directly into memory rather than create an additional file to be read back at a later step. Loading the malware straight into memory makes it more potent; intermediate steps are reduced or eliminated in its path because of where it is located.

CSO Online noted that the malware that ends up in memory performs many tasks. “First it tries to determine if the environment is a virtual machine or sandbox like those used by malware analysts,” author Lucian Constantin wrote.

“It then scans the network configuration for strings like school, hospital, college, health and nurse. It also scans the network for other machines with names including teacher, student, schoolboard, pediatrics, orthoped, as well as POS, store, shop and sale. Cached URLs are scanned for a number of financial websites and names like Citrix and XenApp.”

If the malware finds its named target, a dynamic link library associated with that target is downloaded from its command-and-control server.

The Technique Has Spread

A similar combination of PowerShell and fileless malware was observed by the SANS Institute’s Internet Storm Center. It’s not just PowerSniff, either; the InfoSec Handlers Diary Blog has specifics about variants of this technique that are now showing up, as well.

It bears repeating: Make sure employees don’t open suspicious attachments on Word documents. This exploit is just one of the many bad things that may happen if effective caution isn’t used.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…