Slashdot Mirror
Docs With Malicious Macros Deliver Fileless Malware (csoonline.com)
itwbennett writes: Researchers from Palo Alto Networks warn that attackers are using Word documents with malicious macros and PowerShell to infect computers with fileless malware. The rogue PowerShell script performs a variety of checks on the computer aimed at finding systems that are used to conduct financial transactions and to avoid systems that belong to security researchers as well as medical and educational institutions. "Due to the target-specific details contained within the spam emails and the use of memory-resident malware, this particular campaign should be treated as a high threat," the Palo Alto researchers said in a blog post. A similar combination of PowerShell and fileless malware was observed last week by researchers from the SANS Institute's Internet Storm Center.
Why the fuck is there a Canada flag icon for this submission?
Sorry, if you still have this shit enabled in **2016**, you deserve the pwnag3.
I got hit with a bundle of them, one after another after another, over a couple of weeks. I think I likely kept getting them because I did not read them but simply forwarded them to http://www.acma.gov.au/Citizen.... I assume as part of their spam analysis with a view to prosecution, those went into some ones more law focused inbox. Forwarding them on to your local authorities might not help much but it certainly doesn't hurt and it is still more satisfying than just blocking them and it might, just might lead to keeping the authorities appropriately busy and a prosecution occurring, one can only hope and a little hope is better than none at all. Oh yeah and I most certainly do not run M$ Office - Libre Office for me, for many, many reasons, least of which those much repeated attacks.
Chaos - everything, everywhere, everywhen
If it involves a document, how is it fileless?
How the fuck is this still happening? Its 2016 for Fates sake. How many years and versions of Word/Office have we had to deal with since "Mellissa"?
What was the name of the Operating System this malicious macro malware ran on?
is to become a researcher...?
1995 wants it's News Story back.
You don't understand. This is fileless in the same way as this article is brainless: There was actually a brain (of sorts) at work but it just doesn't count.
Seems in cases like this where the Trojan is entirely in RAM, the best defense would be to have a RAM scanner on the hypervisor level that would scan VMs for things like this, and if found, suspend/snapshot the VM, and allow recovery via various methods (continue with the VM, shut the VM down and run a scan against the disk image, roll the VM back to a safe snapshot, etc.)
With ransomware also a threat, having AV on the hypervisor level can likely be the best defense, especially with VM snapshots coupled with snapshots of shared filesystems.
A lot of antivirus protection happens during file access, which should make "fileless" malware more difficult to detect. The article is a bit fuzzy on whether this malware is truly fileless, however, describing it as "similar" to "fileless malware" that...
creates a registry key that launches a hidden PowerShell instance at every system start-up.
Given that "the registry" is nothing more than a collection of files, writing a key to the registry hardly qualifies as "fileless" operation.