Listen to this Post
A recent discovery by Fortinet’s FortiGuard Labs has revealed a new cybercrime campaign that demonstrates the ongoing threat posed by weaponized Microsoft Word documents. These documents, once a trusted format for many, have now become a powerful tool for attackers seeking to compromise Windows users’ credentials. Leveraging the CVE-2017-11882 vulnerability in Microsoft’s Equation Editor, this campaign deploys a sophisticated attack chain to deliver the FormBook malware. The malware is stealthy, evasive, and capable of stealing sensitive data, making it a significant threat to users and organizations worldwide.
The Attack Chain and How It Works
The campaign begins with a targeted phishing email disguised as a sales order. This email contains a malicious attachment in the form of a Word document named order0087.docx. The document is delivered as a ZIP archive and uses the Office Open XML (OOXML) format to hide its malicious intent. Once opened, the document’s embedded XML triggers the download of an external RTF file (Algeria.rtf) that’s intentionally obfuscated to avoid detection.
Inside this RTF file, two key malicious components are embedded: a 64-bit DLL named AdobeID.pdf and an OLE object containing crafted equation data. This equation data exploits the CVE-2017-11882 vulnerability within Microsoft Equation Editor, triggering a buffer overflow that hijacks the return address of the EQNEDT32.EXE process. This results in remote code execution, activating the malicious DLL with the help of the WinExec() function.
The DLL works as a loader, executing under the rundll32.exe process and establishing persistence on the compromised system. It writes a registry key under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to ensure it starts automatically with Windows.
Payload Delivery: FormBook Malware
Once the initial foothold is established, the malware continues its attack. The DLL retrieves the next stage of the attack: a FormBook malware executable disguised as a PNG image. This image is actually an encrypted binary that is downloaded from a hardcoded external URL.
What makes this stage particularly dangerous is the use of a fileless technique. The malware is decrypted in-memory using a key derived from a hardcoded string, which leaves almost no forensic traces on the system’s disk. Once decrypted, the FormBook malware is injected into a legitimate Windows process (ImagingDevices.exe from Windows Photo Viewer) using process hollowing. This is a method where a process is created in a suspended state, and the malware is injected into it, allowing the malware to run undetected.
After successful injection, FormBook takes control and begins its malicious activities, including stealing credentials, capturing keystrokes, taking screenshots, and exfiltrating clipboard data. These stolen data points are sent to external command-and-control servers for the attacker’s use.
Evading Detection: Anti-Analysis and Persistence Mechanisms
FormBook is designed to be stealthy, with anti-analysis features that help it avoid detection by security software. By selectively modifying CPU registers and using advanced injection techniques, it is able to bypass endpoint detection systems. Moreover, the malware remains persistent on the infected system by maintaining registry entries and hiding within legitimate processes.
Fortinet has confirmed that its FortiGuard services are effective in blocking this attack. The malicious URL, phishing signatures, and antivirus detection tools are all able to identify and block the various components of the attack. However, this campaign underscores the ongoing risks associated with unpatched legacy vulnerabilities, and it highlights the importance of keeping software up to date and maintaining comprehensive security practices.
What Undercode Says:
This campaign highlights several concerning trends in modern cyberattacks, particularly the use of fileless malware techniques. Fileless attacks are becoming increasingly common due to their ability to evade traditional security mechanisms, which typically focus on detecting malicious files on disk. By operating entirely in memory, these attacks leave minimal traces and are harder to analyze post-incident.
The exploitation of CVE-2017-11882 is particularly notable because it is an older vulnerability that, despite its age, continues to be leveraged in sophisticated cyberattacks. This emphasizes the importance of patching vulnerabilities in a timely manner and adopting a “defense-in-depth” security approach, which includes not only regular software updates but also endpoint detection and response (EDR) tools that can identify suspicious activity even when files aren’t involved.
Moreover, the use of trusted applications like Microsoft Word in phishing campaigns reflects the increasing sophistication of cybercriminals. These attackers know that users tend to trust documents they receive in emails, especially when they appear legitimate, such as invoices or order forms. This makes email security and user awareness even more critical.
The injection of FormBook malware into legitimate Windows processes also shows how attackers are adapting to security measures by using well-known system processes as a vehicle for their malicious activities. This technique is particularly effective against traditional antivirus solutions that may focus on blocking standalone malware files rather than monitoring system behavior or process activity.
In addition to technical defenses, organizations must invest in employee training to prevent phishing attacks, which remain one of the most effective methods for delivering malware. Phishing simulations, email filtering, and security awareness campaigns can help users recognize and avoid these types of threats.
Fact Checker Results:
- Phishing and Exploits: The report correctly identifies the use of the CVE-2017-11882 vulnerability in this attack, which has been well-documented in the past. The techniques used to exploit this vulnerability are consistent with previous cybercrime campaigns.
- Fileless Malware: The description of the fileless approach is accurate. The malware’s use of in-memory decryption and injection techniques aligns with current cyberattack trends.
- Security Recommendations: The recommended actions, including patching, user awareness training, and using advanced endpoint protection, are solid and align with best practices in cybersecurity.
References:
Reported By: cyberpress.org
Extra Source Hub:
https://www.twitter.com
Wikipedia
Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
