As they look for attack surfaces to exploit, an increasing number of criminals are turning to Excel 4.0 macros as tools for gaining a foothold in enterprise networks. Newly published research has found that a new wave of these attacks has hit roughly every one to two weeks for the last five months, each one adding evasion techniques and sophistication to its predecessors.
In its report, the Lastline Threat Research Group noted that Excel 4.0 XLM macros are a feature that has existed for more than 30 years. While not the current VBA macro technology, they are still part of the legitimate functionality of Excel. While some organizations disable macro functionality by default, others depend on macros for critical applications. And in those organizations, it can be difficult for security systems to differentiate between legitimate and malicious macros.
According to the report, the malicious macros tend to be loaders, responsible for delivering a variety of commodity malware families, such as Danabot, ZLoader, Trickbot, Gozi, and Agent Tesla to the victim's computers.
Find out more here.
