November 15, 2018 By Douglas Bonderud 2 min read

A recent keylogger campaign leveraged an old Microsoft Office Equation Editor vulnerability to target user credentials, passwords and clipboard content.

As reported by Quick Heal, threat actors used Rich Text Format (RTF) files — either standalone or embedded in PDF files with DOC extensions — to distribute the Hawkeye keylogger malware.

While the attacks used typical phishing emails to target users and organizations, the campaign opted for a less common path to compromise: the Microsoft Office Equation Editor. The so-called “Hawkeye v8 Reborn” exploit CVE-2017-11882, which triggers a stack buffer overflow in Equation Editor by using an unbounded string of FONT name defined within a FONT record structure. If successful, attackers gain the ability to execute arbitrary code and deliver malware payloads.

Latest Version of Hawkeye Keylogger Brings Additional Capabilities

Obfuscation and evasion are critical to Hawkeye’s success. It starts with the use of Equation Editor: Despite a November 2017 fix from Microsoft, many unpatched versions still exist.

In addition, the Hawkeye keylogger attempts to evade detection by compiling code while executing, and loading its payload in memory rather than writing it to disk. By waiting until the last possible moment to compile code and limiting its attack surface to in-memory infections, Hawkeye makes it difficult for security professionals to identify the threat.

Once the keylogger payload is up and running, threat actors have access to myriad functions, including File Transfer Protocol (FTP) copying, mail credential theft and clipboard capture. The malware also leverages antidebugging with SuppressIldasm and ConfuserEx 1.0, and uses legitimate tools such as MailPassView and BrowserPassView to steal passwords. Furthermore, Hawkeye disables antivirus tools, task manager, command prompt and registry, and the restoration service rstrui.exe is also disrupted to prevent file recovery.

How Security Teams Can Dodge Hawkeye’s Attacks

To avoid Hawkeye keylogger campaigns and similar malspam efforts, organizations should start with patching. It comes down to the Pareto Principle: 20 percent of security issues cause around 80 percent of security problems. In the case of CVE-2017-11882, this means applying Microsoft’s November 2017 fix.

Security experts also recommend implementing multilayered malspam defense, including email filtering, endpoint protection and system hardening. Given the ability of determined attackers to bypass these measures, however, it’s also a good idea to deploy automated incident response (IR) processes capable of analyzing emails, extracting indicators of compromise (IoCs), and updating all filtering devices and services with this information.

Source: Quick Heal, Microsoft

More from

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today