Beware of Word: Remcos RAT Lurks in Malicious Documents

A new and sophisticated cyber attack campaign has surfaced, leveraging a weaponized Microsoft Word document to deliver the notorious Remcos Remote Access Trojan (RAT). This insidious malware grants attackers unrestricted control over infected systems, potentially leading to data breaches, surveillance, and other malicious activities.

Researchers at Forcepoint X-Labs have identified a seemingly innocuous Word document (FAKTURA.docx) that acts as the initial infection vector. Upon opening, the document triggers a complex chain of events, exploiting a known vulnerability in Equation Editor (CVE-2017-11882) to download a series of obfuscated scripts. These scripts, meticulously crafted to evade detection, ultimately lead to the deployment of the Remcos RAT.

A notable aspect of this attack is the use of a URL shortener to conceal the malicious download link. This tactic not only bypasses traditional security filters but also tricks unsuspecting users into clicking on seemingly legitimate URLs. The shortened link redirects to a server hosting the exploit code, initiating the infection process.

Once Remcos RAT is installed on a victim’s system, it opens a backdoor for attackers, allowing them to remotely execute commands, steal sensitive data, install additional malware, and even monitor user activity through keylogging and screen capture. The potential consequences of such a compromise are severe, ranging from financial loss and identity theft to corporate espionage and infrastructure sabotage.

One notable technique involves the use of steganography, where malicious binaries are hidden within seemingly innocuous images, in this case, a JPEG file hosted online. The image contains a Base64 encoded string, subtly embedding the malware payload. This method not only conceals the attack but also circumvents traditional security measures that might not flag a JPEG as suspicious.

Additionally, the attack employs a multi-stage obfuscation tactic, where PowerShell scripts are used to decode and execute the payload. This PowerShell script further communicates with a now-inactive C2 (command and control) server, attempting to download additional malicious components.

Organizations and individuals are urged to exercise caution when handling email attachments, even from seemingly trusted sources. Implementing strong endpoint security solutions, keeping software up-to-date, and educating users about safe online practices are crucial steps in mitigating the risks posed by such attacks.