Cisco AMP tracks new campaign that delivers Ursnif
Summary: Cisco Talos spotted Ursnif in the wild after its AMP Exploit Prevention engine alerted on the infections and blocked them from reaching targets. The sample arrives in a Word document with an obfuscated VBA macro that runs PowerShell to download an executable from its C2 into AppData, then uses WMIC and registry keys to execute a hex-encoded PowerShell command that performs APC injection via QueueUserAPC. Ursnif exfiltrates data over HTTPS in CAB files built with makecab.exe and stored in %TEMP% with four-hex-character .bin filenames.
Bottom line: Ursnif compresses stolen keystrokes and window text into CAB files before sending them out over HTTPS, so network monitoring that inspects only raw traffic will miss the exfiltration. The macro hides its payload in a Word shape's AlternativeText property, which means document scanning that looks only at macro code will not see the PowerShell command.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026