Emotet Rises Again: Evades Macro Security via OneNote Attachments

Mar 20, 2023Ravie LakshmananEndpoint Security / Email Security

The notorious Emotet malware, in its return after a short hiatus^[1], is now being
distributed via Microsoft OneNote email
attachments^[2] in an attempt to bypass
macro-based security restrictions and compromise systems.

Emotet^[3], linked to a threat
actor tracked as Gold Crestwood, Mummy Spider, or TA542, continues
to be a potent and resilient threat despite attempts by law
enforcement to take it down.

A derivative^[4]
of the Cridex^[5]
banking worm^[6]
– which was subsequently^[7]
replaced^[8]
by Dridex^[9]
around the same time GameOver Zeus was disrupted in 2014 – Emotet
has evolved^[10] into a “monetized
platform for other threat actors to run malicious campaigns on a
pay-per-install (PPI) model, allowing theft of sensitive data and
ransom extortion.”

While Emotet infections have acted as a conduit^[11] to deliver Cobalt
Strike, IcedID, Qakbot, Quantum ransomware, and TrickBot, its
return in late 2021 was facilitated^[12] by means of
TrickBot.

“Emotet is known for extended periods of inactivity, often
occurring multiple times per year, where the botnet maintains a
steady-state but does not deliver spam or malware,” Secureworks
notes^[13] in its profile of the
actor.

The dropper malware is commonly distributed through spam emails
containing malicious attachments. But with Microsoft taking steps
to block macros in downloaded Office files, OneNote attachments
have emerged as an appealing alternative pathway.

“The OneNote file is simple but yet effective at social
engineering users with a fake notification stating that the
document is protected,” Malwarebytes disclosed^[14] in a new alert. “When
instructed to double-click on the View button, victims will
inadvertently double-click on an embedded script file instead.”

The Windows Script File (WSF) is engineered to retrieve and
execute the Emotet binary payload from a remote server. Similar
findings have been echoed by Cyble^[15], IBM X-Force^[16], and Palo Alto Networks
Unit 42^[17].

That said, Emotet still continues to use booby-trapped documents
containing macros to deliver the malicious payload, employing
social engineering lures to entice users into enabling macros to
activate the attack chain.

Such documents have been observed to leverage a technique called
decompression bomb to conceal a very large file (over 550 MB)
within ZIP archive attachments to fly under the radar, according to
multiple reports from Cyble^[19], Deep Instinct^[20], Hornetsecurity^[21], and Trend Micro^[22].

This is achieved by padding 00-byte^[23] at the end of the
document to artificially inflate the file size so as to exceed the
limitations imposed by anti-malware solutions.

The latest development is a sign of the operators’ flexibility
and agility in switching attachment types for initial delivery to
evade detection signatures. It also comes amid a spike in threat actors^[24] using OneNote documents^[25] to distribute a wide
range of malware such as AsyncRAT, Icedid, RedLine Stealer, Qakbot,
and XWorm.

According to Trellix^[26], a majority of the
malicious OneNote detections in 2023 have been reported in the
U.S., South Korea, Germany, Saudi Arabia, Poland, India, the U.K.,
Italy, Japan, and Croatia, with manufacturing, high-tech, telecom,
finance, and energy emerging as the top targeted sectors.