microsoft office for federal employees 9.99

Another email (Figure 2) purported to be from Security Support for PCI-DSS at a major credit card company with the subject line “Безопасность” (security) and a Microsoft Word attachment (Figure 4) “Требования безопасности.doc” (Safety requirements).įigure 1: Email used to deliver the MWI document (Body translated: “Good day, important to familiarize yourself!”)įigure 2: Email used to deliver the MWI document (Body translated: “Please accept following advice and recommendations regarding necessary safety precautions”)įigure 3: MWI document after the exploit is triggered the lure displays unreadable charactersįigure 4: MWI document after the exploit is triggered the lure describes the different ways to pay for a delinquent MTS (Russian mobile provider) bill.

In the first campaign, the email (Figure 1) purported to be from FinCERT with the subject “Памятка по информационной безопасности” (Information Security Notice) and contained a Microsoft Word attachment named “сводка1705.doc” (report1705) (Figure 3).

While we observed numerous malicious attachments, we describe two here and list the rest in the IOC section. The malicious documents created with MWI for use in these activities delivered Metasploit Stager, Cobalt Strike, and previously undocumented malware we named Cyst Downloader. The actor involved is believed to be the Cobalt group - an actor known to target banks in Europe and Asia and previously documented by Group IB. The emails are sent to technology and security personnel working in departments including Fraud and Information Security. This activity targets organizations in the financial vertical including banks, banking software vendors, and ATM software and hardware vendors.

After the latest update, MWI is now using CVE-2017-0199 to launch an HTML Application (HTA) used for both information collection and payload execution.

We previously reported about MWI when it added support for CVE-2016-4117. MWI is a tool sold on underground markets for creating exploit-laden documents, generally used in targeted attacks. In May, Proofpoint observed multiple campaigns using a new version of Microsoft Word Intruder (MWI).

Microsoft office for federal employees 9.99