Description

Security experts found threat actors, behind the Emotet malware, now using Microsoft OneNote email attachments to distribute Emotet malware to bypass Microsoft security restrictions and target a greater number of devices. Emotet is a notorious malware botnet that previously used Microsoft Excel and Word attachments which included malicious macros for distribution and once opened, it enables macros to get a DLL downloaded and executed to install Emotet malware on the target devices. As per the researchers' report, Emotet malware initially used Word and Excel documents with macros in their campaign, but because Microsoft now blocks automatically macros in attachments, the campaign was not successful. Now a security researcher abel found that the Emotet malware is distributed in their campaign using malicious Microsoft OneNote attachments. These OneNote document attachments were sent using reply-chain emails by impersonating them as guides, how-tos, invoices, job references, and others and these sent emails display a message as protected document to view the content of documents asking victims to 'double-click' on the 'View' button. Later, when the victim double clicks on a 'View' button, an embedded file gets launched which is a hidden malicious VBScript file called 'click.wsf' and it downloads a DLL from a remote compromised website and executes it. This script will then download the Emotet malware as a DLL and store it in the same Temp folder, and then, it launches the random named DLL using regsvr32[.]exe. Further, this dropped Emotet quietly runs on the victim's device to steal email, and contacts and waits for C2 server command execution. Also, the malware payload used in the campaign is not found but usually, it is Cobalt Strike or other malware. Additionally, the distribution of malware using OneNote is increased in multiple campaigns. Hence, windows admins are requested to configure group policies to protect against malicious Microsoft OneNote files.