Security researchers observed that a new Ursnif attack campaign replaced PowerShell with mshta as a means to distribute the malware.

Zscaler observed that the Ursnif campaign began with the delivery of document files bearing the name “info_03_24.doc.” These documents leveraged malicious Visual Basic for Applications (VBA) macro code to call the main routine. This stage involved writing the second-stage payload to “index.html” and executing it.

In contrast to previous campaigns, the second stage of the campaign did not invoke a PowerShell command. Instead, it executed index.html using “mshta.exe,” a utility for executing Microsoft HTML Applications (HTAs). The step executed JavaScript and ActiveX code that created a new function with decoded ASCII data as its function body, among other operations.

The third and final stage leveraged that decoded ASCII data’s instructions to execute and download “index.dll” via regsvr32. In so doing, it installed Ursnif as the campaign’s final payload.

Ursnif’s Fork and Globetrotting Campaigns

Ursnif has been featured in several attack campaigns thus far in 2020. In January, for instance, researchers at FireEye detected malware that identified itself as “SaiGon version 3.50 rev 132.” A closer look revealed that this threat had based itself on the source code of Ursnif v3, suggesting a possible fork in the malware family’s development.

Just a few weeks later, SANS ISC unveiled its discovery of an attack campaign that relied on malspam to target German users with malware. Then, in March 2020, Cybaze-Yoroi Zlab intercepted a campaign in which attackers used a compromised Italian website to target Italian users with the Trojan.

How to Defend Against Malicious Macros

Security professionals can help defend their organizations against campaigns that use malicious macro code by relying on their security information and event management (SIEM) solution to detect malicious macro activity. Specifically, they should use the SIEM to detect the creation of new processes that could be spawned by malicious macros. Infosec personnel should also use tools like a VBA editor to extract and inspect macro code included in suspicious Office documents.

More from

Hackers are Increasingly Targeting Auto Dealers

Auto dealerships are increasingly concerned with cybersecurity in the face of new regulations and an alarming rise in cyberattacks. The Second Annual Global State of Cybersecurity Report by CDK Global found that 85% of dealerships say cybersecurity is very or extremely important relative to other operational areas. Additionally, 89% say cybersecurity is more important than last year, a 12% increase. Not surprisingly, only 37% of auto retailers are confident in the current protection, which is a 21% decrease from 2021.…

Container Drift: Where Age isn’t Just a Number

Container orchestration frameworks like Kubernetes have brought about untold technological advances over the past decade. However, they have also enabled new attack vectors for bad actors to leverage. Before safely deploying an application, you must answer the following questions: How long should a container live? Does the container need to write any files during runtime? Determining the container’s lifetime and the context in which it runs is critical, especially when hosting an internet-facing service. What is Container Drift? When deploying…

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

OneNote, Many Problems? The New Phishing Framework

There are plenty of phish in the digital sea, and attackers are constantly looking for new bait that helps them bypass security perimeters and land in user inboxes. Their newest hook? OneNote documents. First noticed in December 2022, this phishing framework has seen success in fooling multiple antivirus (AV) tools by using .one file extensions, and January 2023 saw an attack uptick as compromises continued. While this novel notes approach will eventually be phased out as phishing defenses catch up,…