19 Oct How to spot Macro-based Malware attachment
In 2015, we observed an increase of macro-based malware along with the spike in spam volume. The majority of the macro-based attacks often start with spammed messages containing attachments such as Microsoft Word document and Excel files. These messages often use attention-grabbing topics, mostly related to finances, such as remittance and invoices for services.
Macro malware, as we have seen throughout the past year or so, is experiencing a revival of sorts, driven by social engineering. Thought to have been banished in the early 2000s, macro malware is proving to everyone that old threats die hard.
What are macros?
Macros are a set of commands or code that are meant to help automate certain tasks, most often used in software such as Microsoft Excel or Word but recently the bad guys have yet again been utilising this heavily to automate their malware-related tasks as well.
What happens when the user opens an attachment and enables macros?
Most documents that carry macro-based ransomware include some sort of explanation or excuse to encourage you to ‘enable editing’ and change your security settings – often, ironically, under the guise of improving security somehow.
Enabling macros in this instance will have the allow the PC to run the code and download the Ransomware as an EXE (Windows program) file, and run it.
To combat macro malware, Microsoft built a permission-based step for enabling macros that serves as a double check. Microsoft Office now disables all macros by default, so macros cannot run without the user’s permission.
The most likely outcome for this type of threat is that the malware will attempt to encrypt all data it can access. This type of malware is termed as Ransomware, and will attempt to encrypt all data the PC or users have access to and render it useless. It will then typically change the user’s desktop with a ransom notice requesting payment in order to receive the key enabling you to unencrypt your data.
Security tips
- Ensure your accounts don’t all have admin rights or access to data they don’t need to have at all times.
- Disable Macros wherever possible
- Use great caution when opening attachments, especially when those attachments carry the .doc or .xls extension.
- Never open unsolicited emails or unexpected attachments—even from known people.
- Implement a robust patching/update cycles on all IT hardware to keep them patched against known vulnerabilities
- If you have mail filters, have it block dangerous file types (e.g. zip files)
- Consider disabling USB ports unless they are essential
- Backup, image based are the best type, but files if nothing else
Being aware of the types of cyber scams is also the best way to prevent being a victim. Test your knowledge in our 10-question Quiz “Are you the weakest link?” to see your ability to stay safe in today’s tech-driven world.
