A weaponized document builder service known as LCG Kit added the ability to use Microsoft Word macros to load the necessary shellcode for installing malware.
Researchers at Proofpoint first detected LCG Kit back in March 2018. At the time of its discovery, the service enabled attackers to deliver Loki Bot malware primarily through RTF documents. It also supported the use of PDFs as well as Microsoft Word/Excel documents with either Object Linking & Embedding (OLE) objects containing Equation Editor code or embedded remote RTF objects.
In September 2018, Proofpoint observed an email campaign involving an Excel attachment that downloaded an HTML file containing VBScript, which then exploited CVE-2018-8174. Two months later, researchers came across an email campaign where Word attachments containing macros loaded LCG Kit shellcode into memory as a way to deliver Loki Bot.
Not the Only Weaponized Document Builder Around
LCG Kit isn’t the only weaponized document builder that’s been observed in the wild. In October 2017, Proofpoint researchers discovered ThreadKit, a service that enabled threat actors to build malicious Microsoft Office documents featuring a variety of exploits and payloads — including banking Trojans such as Trickbot and Chthonic as well as remote-access Trojans (RATs) such as FormBook and Loki Bot.
As reported by Bleeping Computer, the author of ThreadKit eventually sold their tool in May 2018, a move that allowed numerous threat actors — such as the Cobalt group — to use the malicious document builder service for their own attack campaigns.
How to Defend Against LCG Kit’s Malicious Documents
Security professionals can help defend against malicious documents created via LCG Kit and similar services by examining suspicious Office documents. Specifically, organizations should use VBA editor to inspect the macro code of documents and oledump.py tools to extract any malicious elements. They should also create an employee awareness training program that directly tackles user-centric security challenges and aligns with specific business initiatives.
Sources: Proofpoint, Proofpoint(1), Bleeping Computer