Cybercriminals Leverage Excel Vulnerability to Deploy Remcos RAT Malware
November 11, 2024
Vulnerability / Network Security
Recent cybersecurity investigations have unearthed a phishing campaign that propagates a new fileless variant of the notorious Remcos RAT (Remote Control Software). Fortinet FortiGuard Labs, through researcher Xiaopeng Zhang, provided an in-depth analysis, revealing that while Remcos RAT is marketed for legitimate remote desktop purposes, it has been misused by cybercriminals to exfiltrate sensitive data and gain unauthorized access to victims’ systems.
The attack is initiated through phishing emails that entice recipients with purchase order themes, prompting them to engage with a seemingly innocuous Microsoft Excel attachment. However, this document harbors malicious intent, exploiting a known remote code execution vulnerability in Microsoft Office—specifically, CVE-2017-0199, which has a CVSS score of 7.8. When activated, the malicious Excel file downloads an HTML Application (HTA) file named “cookienetbookinetcahce.hta” from a remote server located at “192.3.220[.]22,” utilizing the mshta.exe tool to execute it.
The targets of this campaign are individuals and organizations, particularly those operating within the business sector. While the specific geographical focus of the attack has not been disclosed, the nature of the phishing strategy suggests a broad targeting approach, consistent with trends in cybercrime that often extend globally.
In terms of tactics and techniques as outlined by the MITRE ATT&CK framework, this attack exemplifies several key adversarial strategies. The initial access is gained through the delivery of the phishing email, effectively leveraging social engineering to lure victims into opening the malicious attachment. Following this, persistence is established via the execution of the HTA file, which may allow the attackers to maintain a foothold within the compromised environment.
Privilege escalation might also be a concern, as the malware’s capabilities can enable the attackers to execute administrative commands remotely, depending on the level of access obtained. Furthermore, techniques associated with data exfiltration are likely employed once the threat actors establish control, allowing them to siphon off sensitive information unnoticed.
This evolving trend of phishing campaigns utilizing legitimate software vulnerabilities underscores the critical need for heightened vigilance among businesses. As cyber threats proliferate, understanding the tactics employed by adversaries is paramount for effective defense. Organizations are encouraged to review their cybersecurity protocols and ensure robust measures are in place to mitigate risks associated with such sophisticated attacks.
