Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Payload Trends in Malicious One Note Samples

Summary: Unit 42 analyzed roughly 6,000 malicious OneNote samples from WildFire and found a phishing-like pattern in which attackers embed images and fake buttons that, when clicked, execute an embedded payload such as VBScript, an EXE, or an Office 97-2003 file. The researchers attribute the shift to macros being disabled by default in Office, and found that 99.9% of the samples contained at least one image, with a median of two images per payload type.

Key Takeaway: OneNote ships by default with Office 2019 and Microsoft 365 on Windows, so the lure arrives in software your users already have, and the researchers' EXE sample called back to a local machine on port 4444, a reverse shell that can also serve lateral movement.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related