OfflRouter Malware Has Infected Ukrainian Documents Since 2015, Exposing Confidential Files
Summary
Cisco Talos found more than 100 Ukrainian documents infected by OfflRouter, a multi-module VBA and .NET virus active since 2015. The malware spreads through Word documents and removable drives, and infected documents have been uploaded to public repositories such as the
Key points
- Talos found more than 100 infected documents uploaded to VirusTotal from Ukraine, containing potentially confidential government and police information.
- OfflRouter has reportedly been active since 2015 and remains present on some Ukrainian organizations’ networks.
- Opening an infected Word document with macros enabled drops and runs ctrlpanel.exe, which infects other Word documents.
- The .NET component targets .doc files, searches fixed and removable drives and recent Word documents, and can spread through shared documents or USB media.
- OfflRouter can search removable drives for Base64-encoded .orp plugin files, decode and execute them, and copy plugins from infected systems to removable media.
- The malware attempts to establish startup persistence and alter Office macro settings, though Talos describes flaws that may limit its spread.
- Infected documents have been uploaded to publicly accessible repositories, creating a risk that confidential information is exposed.
Article Details
- Attack Vectors
- Malicious Word documents containing VBA code drop and execute ctrlpanel.exe when opened with macros enabled.
- OfflRouter searches fixed and removable drives and recent Word documents for .doc files to infect.
- The malware can search removable media for .orp plugin files, decode and execute them, and copy existing plugins to removable media.
- Defensive Notes
- Cisco Talos recommends detecting and blocking the malware with Cisco Secure Endpoint, Cisco Secure Firewall, Cisco Secure Malware Analytics, and other listed Cisco security products.
- Keep ClamAV signatures Doc.Malware.Valyria-6714124-0 and Win.Virus.OfflRouter-10025942-0 up to date.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 016d90f337bd55dfcfbba8465a50e2261f0369cd448b4f020215f952a2a06bce | Hash listed for an infected document. |
| SHA256 | 10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8 | Hash of the OfflRouter .NET module, ctrlpanel.exe. |
| SHA256 | 2260989b5b723b0ccd1293e1ffcc7c0173c171963dfc03e9f6cd2649da8d0d2c | Hash listed for an infected document. |
| SHA256 | 2b0927de637d11d957610dd9a60d11d46eaa3f15770fb474067fb86d93a41912 | Hash listed for an infected document. |
| SHA256 | 802342de0448d5c3b3aa6256e1650240ea53c77f8f762968c1abd8c967f9efd0 | Hash listed for an infected document. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe VBA code reconstructs the executable from encoded integer values, and plugin files are Base64-decoded before execution.T1059.005 · Visual BasicOfflRouter uses VBA macro code in Word documents to drop and run its executable module and to generate code that infects other documents.T1204.002 · Malicious FileThe VBA component runs when a user opens an infected Word document with macros enabled.T1547.001 · Registry Run Keys / Startup FolderThe executable attempts to set the Ctrlpanel registry Run value for startup persistence, but the article says this measure fails because the value lacks the full executable path.
Malware
Vendors
Products
Microsoft Officecreated in the Word 97-2003 binary format (OLE2), the document will be saved with the same name in Microsoft Office Open XML format with enabled macros (DOCX). Microsoft WindowsWhen the virus is run, it attempts to set the value Ctrlpanel of the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\Run so that it runs on the Windows boot. An internal global string _RootDir is used as theVirusTotalOfflRouter virus causes Ukrainian users to upload confidential documents to VirusTotalWordThe results of the investigation have shown that the presence of the malicious code is due to the activity of a rare multi-module virus that's delivered via the .NET interop functionality to infect Word documents.