Russian Threat Group Targets Microsoft Outlook With Malware

S2 Grupo’s intelligence team discovered a new Outlook backdoor linked to a Russian-linked persistent threat group known as APT28. The researchers explained how the threat actors are leveraging a legitimate signed binary to deploy the backdoor, then loading a malicious file to disable macro security defenses. Once this is done, the VBA macro is delivered into targeted networks. 

“APT28 is abusing Outlook as a covert channel through a VBA macro backdoor named NotDoor,” Jason Soroko, Senior Fellow at Sectigo, explains. “Delivery uses DLL sideloading of a malicious SSPICLI.dll by the signed OneDrive.exe to disable macro protections and stage commands. The macro watches inbound mail for a trigger word and can exfiltrate data upload files and run commands. This blends with trusted binaries and normal mail flow and can slip past perimeter tools and basic detections.”