Open Document format creates twist in maldoc landscape
Summary: Cisco Talos reported multiple malware campaigns using OpenDocument (ODT) files that evade antivirus because engines treat ODT files as standard archives rather than Office documents, and several sandboxes fail to analyze them. Talos walked through three cases: two delivered NJRAT and RevengeRAT via OLE objects and HTA scripts downloading from top4top[.]net, and a third targeting only OpenOffice and LibreOffice users delivered AZORult through a fake "Spotify.exe" .NET binary.
What's compelling: Talos assesses with medium confidence that the two RAT campaigns are linked by the same actor or framework, and notes that LibreOffice's public migration page gives attackers OSINT on which infrastructures run the software - a lesser-used file format paired with low detections can raise an actor's success rate against a smaller, more targeted population.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026