Hackers Increasingly Use Microsoft OneNote to Deliver Malware

OneNote documents are more and more being utilized by likelihood actors to ship malware to unsuspecting stop customers by email, in step with Proofpoint researchers. It infects victims with faraway receive entry to malware that might perhaps perhaps also be used to set up extra malware, rob passwords, or even receive entry to cryptocurrency wallets.

Microsoft developed the digital notebook OneNote, which is available within the market by the Microsoft 365 product suite.

“Risk actors drawl malware by OneNote documents, that are .one extensions, by email attachments and URLs”, Proofpoint researchers

After years of employing malicious Be aware and Excel attachments that delivery macros to download and set up malware, attackers are now using this technique to unfold malware by emails.

Microsoft, on the different hand, lastly banned macros as the default setting in Self-discipline of business documents in July, rendering this approach ineffective for spreading malware.

Reports deliver Messages every infrequently beget OneNote file attachments with themes similar to bill, remittance, shipping, and seasonal themes similar to Christmas bonus, amongst diversified topics.

“The OneNote documents beget embedded files, assuredly hidden within the support of a graphic that appears to be admire a button. When the customer double-clicks the embedded file, they’ll be prompted with a warning. If the customer clicks proceed, the file will attain”, show the researchers

A form of executables, shortcut (LNK) files, and script files, similar to HTML capabilities (HTA) or Home windows script files (WSF), is at likelihood of be reveal within the file.

Within the December campaign, a OneNote attachment in messages contained an HTA file that launches a PowerShell script to download an executable (admire Excel.exe) from a URL. These communications were directed at companies within the industrial and manufacturing sectors.

Be taught says thousands of communications were sent out as allotment of diversified efforts that made utilize of bill and shipment themes, as neatly as “Christmas bonus” or “Christmas reward” lures that essentially centered companies within the educational sector and diversified industries.

“The campaigns persisted to utilize the identical TTPs, with hidden embedded files within the OneNote attachment that ultimately lead to the download of a malware payload”, researchers.

“In more than one campaigns, the actors used the legitimate products and companies “OneNote Gem” and Transfer.sh to host payloads”.

Additional, one campaign employing bill themes and distributing XWorm and AsyncRAT became found by researchers. The lure used each English and French. An OneNote attachment in messages had a PowerShell script that is at likelihood of be used to download a batch file (system32.bat) from a URL.

“On 19 January 2023, seen a low-quantity campaign distributing the DOUBLEBACK backdoor. DOUBLEBACK is an in-reminiscence backdoor that can enable host and network reconnaissance, files theft, and apply-on payloads”, researchers

Messages contained URLs on quite a lot of domains with a URI ending with /download/[guid]. The actor presupposed to previously have contacted the sufferer and that the linked files had been uploaded to cloud storage.

The sufferer became suggested to “Double Click on To Take into consideration File” by the template. OneNote would strive to bustle a VBS file hidden within the support of the button. The sufferer might perhaps perhaps presumably perhaps be warned about the safety considerations earlier than being allowed to delivery attachments. If the sufferer kept going, the VBS might perhaps perhaps presumably perhaps be performed to the stop.

On January 31, 2023, the initial receive entry to broker TA577 resumed operation after a one-month absence and delivered Qbot with an assault chain that capabilities OneNote. Emails with a undeniable URL within the email physique perceived to acknowledge to earlier conversations.

If the sufferer double-clicked the file and confirmed the safety prompt, researchers deliver JavaScript code became accomplished that downloads a file from a faraway URL and displayed a unfounded error message.

Final Be aware

Researchers suspect that quite a lot of likelihood actors are making an strive to receive round likelihood detections by employing OneNote attachments.

An assault can only succeed if the aim interacts with the attachment—more precisely within the occasion that they click on on the embedded file and ignore the OneNote warning. Stop customers must be informed about this tactic by organisations, and customers must be urged to memoir suspicious emails and attachments.