Microsoft’s Security Intelligence team warns of a new malware campaign that infects and compromises fully patched Windows PCs, and which spreads via malicious macro functions in an Excel attachment to activate “a complex infection chain to download and run the notorious FlawedAmmyy remote access trojan directly in memory.” Microsoft recommends disabling macros. A Virsec expert offers thoughts.
https://twitter.com/Ttschersich/status/1143537775943270401
Expert Comments:
Satya Gupta, CTO and Co-founder at Virsec:
Excel macros have been associated with malware for a long time, but it’s still alarming for Microsoft to recommend disabling all macros – functions used routinely by millions of businesses. Microsoft needs to rethink its macro strategy as it has become an easy vehicle for malware to get into fully patched systems. Below the surface we also need a new approach to in-memory attacks that are being launched through these macros. However these threats get in the front door (and there’s almost always a way in…) once in memory these attacks are undetectable by most security products and leave few traces behind after an application is done executing.
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
