Macro malware was a big player in the malicious code market 20 years ago. According to SC Magazine, it’s now back at large thanks to a newly discovered Neutrino bot (also known as Kasidet) dropper looking to open backdoors and grab user data with memory scraping and browser-hooking malware. But why the sudden uptick in this outdated method? More importantly: How come it’s working so well?

What’s Old Is New Again

As noted by Dark Reading, the new Kasidet dropper uses Visual Basic for Applications (VBA) macros found in Microsoft Office to deliver its malicious payload. It all starts when users open the *.doc file attached to an unsolicited email, which prompts them to turn on macros.

Along with a nonsense document, however, they get a Neutrino infection that hooks into any browsers and includes point-of-sale (POS) RAM-scaping malware. Although Microsoft took steps to mitigate the use of macro malware — and things were relatively quiet for 15 years — in the last 18 months, this attack method has enjoyed significant growth, even with employees (hopefully) educated about the dangers of opening unsolicited emails.

It’s also worth noting that Kasidet’s creators have been busy upgrading their code. The original version included multiple distributed denial-of-service (DDoS) features, while the new offering comes with high-risk POS targeting. Simply put? What’s old is new again as malware-makers leverage finite user memories to spread a whole new set of macro malware.

Increasingly Sophisticated

A reliance on old infection methodologies doesn’t mean these malware-makers lack ingenuity. Consider a recent Graham Cluley blog post detailing another Neutrino infection attempt: There, the document in question seemingly came from a linked network printer simply delivering a scanned document.

It’s clever, especially in a network setting where users don’t know offhand the exact model number and type of printers used by every department. With seemingly legitimate email origins, it’s not hard to see why some employees are duped into opening the attachment and enabling the requested macros.

Business Solutions, meanwhile, pointed to a rise in not only macro attacks, but also fileless malware that loads directly into the memory space of specific functions, hides behind APIs or lurks in the system registry. Combined with effective macro malware spear phishing, the results can be devastating: Employees used to getting macro-laden documents from somewhat familiar addresses gladly open attachments that in turn drop POS scrapers or even harder-to-detect fileless infection vectors onto corporate networks.

Managing Macro Malware

This kind of macro madness won’t last forever. As businesses wise up and detection methods improve, malicious actors will modify their approach. In the interim, however, the return to old-school infection methods demands a similar replay of past-tense responses: If employees aren’t expecting a specific document, they should ignore or delete the email.

If uncertain, email the sender directly, and if it’s from a printer or scanner and wasn’t directly requested, notify IT. Bottom line? Macros are back, and companies need to micromanage email handling until malware-makers take their trade somewhere else.

More from

$10.3 Billion in Cyber Crime Losses Shatters Previous Totals

4 min read - The introduction of the most recent FBI Internet Crime Report says, “At the FBI, we know ‘cyber risk is business risk’ and ‘cybersecurity is national security.’” And the numbers in the report back up this statement. The FBI report details more than 800,000 cyber crime-related complaints filed in 2022. Meanwhile, total losses were over $10 billion, shattering 2021's total of $6.9 billion, according to the bureau’s Internet Crime Complaint Center (IC3).  Top Five Cyber Crime TypesIn the past five years, the…

4 min read

How to Boost Cybersecurity Through Better Communication

4 min read - Security would be easy without users. That statement is as absurd as it is true. It’s also true that business wouldn’t be possible without users. It’s time to look at the big picture when it comes to cybersecurity. In addition to dealing with every new risk, vulnerability and attack vector that comes along, cybersecurity pros need to understand their own fellow employees - how they think, how they learn and what they really want. The human element — the individual and social factors that…

4 min read

Detecting Insider Threats: Leverage User Behavior Analytics

3 min read - Employees often play an unwitting role in many security incidents, from accidental data breaches to intentional malicious attacks. Unfortunately, most organizations don’t have the right protocols and processes to identify potential risks posed by their workforce. Based on a survey conducted by SANS Institute, 35% of respondents said they lack visibility into insider threats, while 30% said the inability to audit user access is a security blind spot in their organizations. In addition, the 2023 X-Force Threat Intelligence Index reported that…

3 min read

Poor Communication During a Data Breach Can Cost You — Here’s How to Avoid It

5 min read - No one needs to tell you that data breaches are costly. That data has been quantified and the numbers are staggering. In fact, the IBM Security Cost of a Data Breach estimates that the average cost of a data breach in 2022 was $4.35 million, with 83% of organizations experiencing one or more security incidents. But what’s talked about less often (and we think should be talked about more) is how communication — both good and bad — factors into…

5 min read