Threat actors using Macro Pack to deploy Brute Ratel, Havoc and Phantom Core payloads
Summary: Cisco Talos found several malicious documents built with the MacroPack framework, which generates VBA payloads in Office files, scripts and shortcuts, and traced their shared code to the tool's professional version. The samples, uploaded to VirusTotal from China, Taiwan, Pakistan and Russia between March 2023 and July 2024, delivered Havoc demons, Brute Ratel badgers and a Golang backdoor called PhantomCore, with lures ranging from generic 'enable content' prompts to fake Pakistani Air Force award and employment documents.
What's compelling: MacroPack's professional version adds four non-malicious VBA subroutines and Markov chain-generated variable names specifically to lower code entropy and slip past anti-malware heuristics, so signature-based detection on file content is the control these samples were built to defeat. Talos could not attribute the actors to a specific group and noted some samples were confirmed red team activity, leaving defenders unable to rule out either explanation for a document that reaches their users.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026