Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins

Summary: Cisco Talos reports that Microsoft began rolling out Office versions in July that block VBA macros by default when a document carries a Mark Of The Web tag, prompting researchers to examine Office add-ins as an alternative infection vector. XLL files are standard Windows DLLs that Excel loads through the Add-In manager, and an XLL implementing the exported function xlAutoOpen runs its code when loaded, with malware authors adopting the free Excel-DNA framework to build them in .NET. Talos' VirusTotal search found no conclusively malicious XLLs until July 2017, when a test sample launching calc.exe and a Meterpreter reverse shell sample were submitted, with usage staying sporadic until late 2021 when commodity families such as Dridex and Formbook began using XLLs.

Why it matters: Blocking VBA macros closes one door, but XLL add-ins open another that Excel loads by design, and Talos notes the warning shown before an XLL loads is often disregarded by users. Malicious XLL activity predates Microsoft's macro change by years, with Dridex and Formbook adopting it at the end of 2021, so the shift in technique is already underway rather than hypothetical.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related