December 7, 2018 By Douglas Bonderud 2 min read

New macro downloaders are using Microsoft Publisher (PUB) files and spam emails to serve up network compromise in the food and retail sectors.

According to Trend Micro, the campaign ramped up late last month with over 50 food and retail companies spammed between Nov. 20–27. Targets included food sector companies Starbucks and Taco Del Mar and retailers Harris Teeter and Save Mart Supermarkets. Trend Micro also detected attacks against the U.S. Department of Agriculture and the financial sector dating to the first week in November.

Setting this campaign apart is its use of PUB files, which are not commonly associated with macro malware. Combined with socially engineered spam emails from “operations teams,” these PUB invoices appear legitimate. Once opened, they serve up malicious Microsoft Installer (MSI) files that contact command-and-control (C&C) servers to install remote access Trojans (RATs). Given the lack of PUB files used by macro downloaders and the use of MSI files for legitimate installations, infections may go unnoticed by both users and standard antimalware tools.

Spam Is a Recipe for Disaster During the Holidays

Both retail and food companies are gearing up for their busiest quarter of the year, which could increase their likelihood of falling victim to spam attacks. Cybercriminals’ use of PUB files enhances this risk, since employees may not recognize these files as potential threats. Intalled RATs can then hide in plain sight until attackers are ready to conduct reconnaissance or download new malware tools.

The campaign also prioritizes evasion by scheduling the MSI file download rather than completing it immediately after PUB files are opened. This not only delays infection to confound security measures, but assigns “msiexec” to scheduler processes, allowing it to be automatically downloaded and installed.

Address the Threat of Macro Downloaders and PUB Attacks

Seasonal spam campaigns come with a high price: Lurking RATs could target customer data or compromise corporate networks. To avoid sneaky PUB attacks, IBM experts recommend invest in layered email security services that combine perimeter protection, external mail scanning and spam control. Security teams should also segment their networks to separate critical services, point-of-sale (POS) information and consumer financial data and limit the damage caused by successful spam deliveries.

Source: Trend Micro

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today