Malicious Software Attackers Leveraging MacroPack to Distribute Chaos, Strong Arm, and ShadowCore
Adversaries are likely using a utility designed for red teaming exercises to deliver malicious software, as per recent discoveries from Cisco Talos.
The application under scrutiny is a payload creation platform known as MacroPack, which is employed to produce Office files, Visual Basic scripts, Windows shortcuts, and other file types for penetration testing and social engineering evaluations. It was created by French programmer Emeric Nasi.
The cybersecurity firm mentioned that it identified artifacts uploaded to VirusTotal from China, Pakistan, Russia, and the U.S. that were all generated using MacroPack and utilized to deploy various payloads such as Chaos, Strong Arm, and a new iteration of ShadowCore, a remote access trojan (RAT) linked to a hacktivist faction called Head Mare.
“A shared characteristic in all the malevolent files we examined that grabbed our notice is the presence of four non-harmful VBA subroutines,” Talos analyst Vanja Svajcer mentioned.
“These subroutines were present in all the samples and were not obscured. They also had never been utilized by any other malicious subroutines or elsewhere in any files.”
An important point to highlight here is that the enticement themes across these files vary, encompassing generic subjects instructing users to enable macros to official-looking documents appearing to originate from military establishments. This implies the engagement of diverse threat actors.
Some of the files have also been seen exploiting advanced functionalities provided as part of MacroPack to evade anti-malware heuristic detections by hiding the malevolent operations using Markov chains to generate apparently meaningful functions and variable names.
The attack sequences, witnessed between May and July 2024, follow a three-stage procedure whereby a booby-trapped Office file containing MacroPack VBA code is sent, which then decodes a subsequent-stage payload to ultimately retrieve and run the final malware.
The development signifies that malicious actors are continuously refining strategies in reaction to disturbances and adopting more advanced methods for code execution.
About Author
