Attackers took a sophisticated dropper and disguised it as a fake DHL shipping invoice to distribute Ursnif malware.

Deep Instinct recently came across an attack email that attempted to trick people into opening a fake DHL invoice. This notice was actually an Excel spreadsheet that prompted users to enable a VBA macro contained therein.

Once activated, the macro displayed a fake progress bar to trick the user into thinking the malicious document was legitimate while it secretly ran malicious code in the background. The macro was also obfuscated and contained randomly generated comments to make the code appear benign and help it evade detection by security solutions.

After loading the fake progress bar, the VBA macro read a portion of the Excel file, called WMIC.exe, using a Shell() function and executed a PowerShell command. This PowerShell code also came with multiple layers of obfuscation, encoding and compression. Ultimately, the code executed the campaign’s Ursnif malware payload.

A History of DHL Malware Campaigns

This is not the first time threat actors have disguised their malware campaigns as DHL correspondence. Back in 2018, for instance, Yoroi Security discovered a malspam campaign that used the cover of a message from DHL to target Italian users with Gozi/Ursnif/IFSB/Dreambot variants.

That was just a few months before SI-Lab spotted a DHL-themed phishing campaign pushing Muncy malware. Not long thereafter, My Online Security saw an email that pretended to deliver a DHL shipment notification, but actually used a link in the email body and two Microsoft Word documents to spread various malware.

How to Defend Against Ursnif Attacks

Security professionals can help defend their organizations against DHL-themed Ursnif attacks by using ahead-of-threat detection to spot potentially malicious domains before they become active in phishing campaigns and other attacks. Organizations should also use test phishing engagements to educate their employees and test their awareness of social engineering attacks.

More from

New Attack Targets Online Customer Service Channels

An unknown attacker group is targeting customer service agents at gambling and gaming companies with a new malware effort. Known as IceBreaker, the code is capable of stealing passwords and cookies, exfiltrating files, taking screenshots and running custom VBS scripts. While these are fairly standard functions, what sets IceBreaker apart is its infection vector. Malicious actors are leveraging the helpful nature of customer service agents to deliver their payload and drive the infection process. Here’s a look at how IceBreaker…

Operational Technology: The evolving threats that might shift regulatory policy

Listen to this podcast on Apple Podcasts, Spotify or wherever you find your favorite audio content. Attacks on Operational Technology (OT) and Industrial Control Systems (ICS) grabbed the headlines more often in 2022 — a direct result of Russia’s invasion of Ukraine sparking a growing willingness on behalf of criminals to target the ICS of critical infrastructure. Conversations about what could happen if these kinds of systems were compromised were once relegated to “what ifs” and disaster movie scripts. But those days are…

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…