Living-off-the-land attacks aren’t new. They’re tactics in which attackers misuse tools native to an infected device. They do this in an effort to not install any foreign files or tools as a means. That way, most security tech won’t notice something odd going on. We’ve taken a look at one of these, misuse of AutoHotkey, and how to prevent it.

Several attackers involving living-off-the-land methods have made headlines in recent years. For example, a threat actor known as Gallmaker used the Microsoft Office Dynamic Data Exchange protocol back in 2018 to spy on its victims. A year later, attackers misused the Windows Management Instrumentation Command tool to distribute Astaroth.

What Is AutoHotkey?

What is new is attackers’ decision to misuse AutoHotkey. This is a Microsoft product, an open-source scripting language designed for machines running Microsoft Windows. AutoHotkey scripts can automate repetitive tasks in a Windows app by creating macros, shortcuts or hotkeys.

How Are Malware Actors Using AutoHotkey Scripts?

One of the first publicly reported attacks involving AutoHotkey was a credential stealer written in AutoHotkey found in March 2018. It disguised itself as Kaspersky Antivirus and spread via infected USB devices. The threat, dubbed Fauxpersky, dropped four files into the affected environment. Together, those files launched a keylogger. This sent the stolen user input to the attackers and then distributed the threat to other removable media.

Fast forward to December 2020, when Trend Micro discovered a malicious Excel file concealing an AutoHotkey script compiler executable, a malicious AutoHotkey script file and a VBA AutoOpen macro. The operation used the script file to profile victims and perform different tasks. Those included harvesting credentials from a victim’s browser and sending them to the attackers.

A few months later, Cofense came across two phishing emails targeting Spanish users. One of the emails instructed the recipient to download a file protected by a password. Meanwhile, the other prompted recipients with the lure of pending legal documents. These payloads used either the Microsoft Service Identity service or a malicious Finger command to create a second .zip file. This archive contained three items: a real AutoHotkey compiler executable, a malicious AutoHotkey script and the Mekotio banking Trojan as a .dll. Once loaded, Mekotio attempted to load fake webpages for targeted banks. It also watched for bitcoin addresses that were copied to the clipboard.

Which brings us to a recent attack: in mid-May 2021, a remote access Trojan delivery campaign began with an AutoHotkey-compiled script. This script loaded an executable that, when it ran, branched into one of four versions. These involved different VBScripts and malware payloads including VjW0rm, Houdini and HCrypt.

How to Defend Against These New Attacks

The campaigns above highlight the need for employers to defend themselves against attacks via AutoHotkey scripts. One of the ways they can do that is by restricting phishing emails and other attacks that could deliver malicious AutoHotkey compiler executables. They can do this by investing in a security awareness training program that uses phishing tests to make employees familiar with email-based attacks. You can balance these human controls with technical measures, as well. Think email banners that signal when a message has come from outside of the group.

Beyond awareness training, you can also take steps to defend against fileless attacks. This involves carefully reviewing the native apps and tools that your employees need for their normal work. With that knowledge, security personnel can then disable whichever are not needed.

More from News

More School Closings Coast-to-Coast Due to Ransomware

Instead of snow days, students now get cyber days off. Cyberattacks are affecting school districts of all sizes from coast-to-coast. Some schools even completely shut down due to the attacks. The federal government recently warned that K-12 schools face a growing threat from cyber groups. According to the FBI, school districts often have limited cybersecurity protections, which makes them even more vulnerable. The FBI also says it anticipates the number of threats to increase. In a recent warning, the nation’s…

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

LastPass Breaches Cast Doubt on Password Manager Safety

In 2022, LastPass suffered a string of security breaches which sparked concern among cyber professionals and those impacted by the intrusions. Some called into question the way LastPass handled and responded to the incident. In addition, the situation ignited a wider conversation about the risks linked to utilizing password managers. A password manager helps users generate strong passwords and safeguards them within a digital locker. A master password secures all data, which enables users to conveniently access all their passwords…

Good Guys Decrypt Ransomware Targeting Charitable Groups

Imagine you’re an IT manager amid a ransomware attack. While your team scrambles for solutions, the intruders demand a ransom. Of course, you don’t want to pay; you just want your files back. But as time ticks by and the extortionists turn up the heat, your bosses are about to give in and pay the ransom. But then, the FBI calls. “Don’t pay,” the agent says. “We’ve found someone who can crack the encryption.” Sound too good to be true?…