Category Archives: Microsoft Office

New Adobe Flash Zero-Day Exploit Found Hidden Inside MS Office Docs

Cybersecurity researchers have discovered a new zero-day vulnerability in Adobe Flash Player that hackers are actively exploiting in the wild as part of a targeted campaign appears to be attacking a Russian state health care institution. The vulnerability, tracked as CVE-2018-15982, is a use-after-free flaw resides in Flash Player that, if exploited successfully, allows an attacker to execute

Microsoft Fixed Outlook 2010 Crashes Triggered By November Patch Tuesday

While an update bundle supposedly addresses flaws, Microsoft November Patch Tuesday didn’t seem so good for users. After the update,

Microsoft Fixed Outlook 2010 Crashes Triggered By November Patch Tuesday on Latest Hacking News.

Hackers May Exploit Microsoft PowerPoint For Malware Attacks

Microsoft Office tools, particularly, the Word, Excel, and PowerPoint, have always enticed criminal hackers due to their popularity among the

Hackers May Exploit Microsoft PowerPoint For Malware Attacks on Latest Hacking News.

Threat Actors Exploit Equation Editor to Distribute Hawkeye Keylogger

A recent keylogger campaign leveraged an old Microsoft Office Equation Editor vulnerability to target user credentials, passwords and clipboard content.

As reported by Quick Heal, threat actors used Rich Text Format (RTF) files — either standalone or embedded in PDF files with DOC extensions — to distribute the Hawkeye keylogger malware.

While the attacks used typical phishing emails to target users and organizations, the campaign opted for a less common path to compromise: the Microsoft Office Equation Editor. The so-called “Hawkeye v8 Reborn” exploit CVE-2017-11882, which triggers a stack buffer overflow in Equation Editor by using an unbounded string of FONT name defined within a FONT record structure. If successful, attackers gain the ability to execute arbitrary code and deliver malware payloads.

Latest Version of Hawkeye Keylogger Brings Additional Capabilities

Obfuscation and evasion are critical to Hawkeye’s success. It starts with the use of Equation Editor: Despite a November 2017 fix from Microsoft, many unpatched versions still exist.

In addition, the Hawkeye keylogger attempts to evade detection by compiling code while executing, and loading its payload in memory rather than writing it to disk. By waiting until the last possible moment to compile code and limiting its attack surface to in-memory infections, Hawkeye makes it difficult for security professionals to identify the threat.

Once the keylogger payload is up and running, threat actors have access to myriad functions, including File Transfer Protocol (FTP) copying, mail credential theft and clipboard capture. The malware also leverages antidebugging with SuppressIldasm and ConfuserEx 1.0, and uses legitimate tools such as MailPassView and BrowserPassView to steal passwords. Furthermore, Hawkeye disables antivirus tools, task manager, command prompt and registry, and the restoration service rstrui.exe is also disrupted to prevent file recovery.

How Security Teams Can Dodge Hawkeye’s Attacks

To avoid Hawkeye keylogger campaigns and similar malspam efforts, organizations should start with patching. It comes down to the Pareto Principle: 20 percent of security issues cause around 80 percent of security problems. In the case of CVE-2017-11882, this means applying Microsoft’s November 2017 fix.

Security experts also recommend implementing multilayered malspam defense, including email filtering, endpoint protection and system hardening. Given the ability of determined attackers to bypass these measures, however, it’s also a good idea to deploy automated incident response (IR) processes capable of analyzing emails, extracting indicators of compromise (IoCs), and updating all filtering devices and services with this information.

Source: Quick Heal, Microsoft

The post Threat Actors Exploit Equation Editor to Distribute Hawkeye Keylogger appeared first on Security Intelligence.

Unpatched Microsoft Word Video Feature Vulnerability is Being Exploited In The Wild

Last month, researchers from a cybersecurity firm shared their findings on a bug in Microsoft Word online’s video feature that

Unpatched Microsoft Word Video Feature Vulnerability is Being Exploited In The Wild on Latest Hacking News.

Unpatched MS Word Flaw Could Allow Hackers to Infect Your Computer

Cybersecurity researchers have revealed an unpatched logical flaw in Microsoft Office 2016 and older versions that could allow an attacker to embed malicious code inside a document file, tricking users into running malware onto their computers. Discovered by researchers at Cymulate, the bug abuses the 'Online Video' option in Word documents, a feature that allows users to embedded an online