Tuesday, May 13, 2025
HomeBackdoorNew Microsoft Office Vulnerabilities Used to Distribute Zyklon Malware that Creating Backdoor

New Microsoft Office Vulnerabilities Used to Distribute Zyklon Malware that Creating Backdoor

Published on

SIEM as a Service

Follow Us on Google News

Recently patched critical Microsoft office vulnerabilities are used for distributing powerful Zyklon Malware that has some sophisticated functionalities such as creating a backdoor in victims machine.

Zyklon Malware has widely spread across the world since 2016 and its mainly targeting Telecommunications, Insurance, Financial Services.

A Backdoor that creates by Zyklon Malware has capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal.

- Advertisement - Google News

Zyklon Malware Http being advertised in a popular underground marketplace with following Prices.

  • Normal build: $75 (USD)
  • Tor-enabled build: $125 (USD)
  • Rebuild/Updates: $15 (USD)
  • Payment Method: Bitcoin (BTC)

This malware downloads several plugins in a browser that will be later performing cryptocurrency mining and password recovery.

Also Read: Skygofree – Highly Sophisticated Android Spyware Discovered that Almost Steal Everything in Your Mobile

How does Microsoft Office Vulnerabilities Exploited

Zyklon malware initially delivering through malicious spam emails that contain attached Zip file that has embedded malicious DOC file.

Once victims click the email, malware exploits 3 known Microsoft office vulnerabilities and PowerShell payload takes over the victims computer.

Later PowerShell script will communicate with Command & Control server and download the final payload and execute it in a victims machine.

According to FireEye Report, its exploit 3  Following Critical vulnerabilities,

  • CVE-2017-879
  • CVE-2017-11882
  • Dynamic Data Exchange (DDE) Mechanism 
The CVE-2017-879 vulnerability that discovered in September 2017 exploit using DOC file contains an embedded OLE Object that, upon execution, triggers the download of an additional DOC file from the stored URL.
CVE-2017-1188 exploit the MS office using  embedded OLE Object downloaded file, doc.doc, is XML-based and contains a PowerShell command and execute the payload
Dynamic Data Exchange (DDE) is the interprocess communication mechanism that is exploited to perform remote code execution. With the help of a PowerShell script

All these vulnerabilities are using same domain is used to download the next level payload using another PowerShell script and it is responsible for resolving the APIs required for code injection.

It also contains the injectable shellcode. The APIs contain VirtualAlloc(), memset(), and CreateThread(). Figure 9 shows the decoded Base64 code.

The malware may communicate with its command and control (C2) server over The Onion Router (Tor) network and the malware sends a POST request to the C2 server.

Also, this Malware performing additional capabilities such as  Browser Password Recovery, FTP Password Recovery, Gaming Software Key Recovery, Email Password Recovery, License Key Recovery.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Marks & Spencer Confirms Customer Data Breach in Recent Cyber Attack

British retail giant Marks & Spencer has officially confirmed that customer personal data was...

Zoom Workplace Apps Flaws Allow Hackers to Gain Elevated Access

Zoom has released multiple security bulletins addressing seven newly discovered vulnerabilities in Zoom Workplace...

PoC Exploit Published for macOS Sandbox Escape Vulnerability (CVE-2025-31258)

Security researchers have disclosed a new macOS sandbox escape vulnerability tracked as CVE-2025-31258, accompanied...

Four Hackers Caught Exploiting Old Routers as Proxy Servers

U.S. authorities unsealed charges against four foreign nationals accused of operating a global cybercrime...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Researchers Uncover Remote IT Job Fraud Scheme Involving North Korean Nationals

The United States indicted fourteen North Korean nationals for orchestrating a sophisticated scheme to...

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware...

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as...