Red Security

Quote:The Microsoft Office is one of the most popular tools, it’s popularity was abused by cybercriminals to deliver malware.


With this current campaign attacker used Excel file with password-protected, to open the file victims should enter the password and it is included in the social engineered email.

To decrypt the password-protected file victims need to enter the password “VelvetSweatshop“, once decrypted it onboards the malicious macros embedded.

The final payload is the LimeRAT malware, a malicious remote access trojan that gives the attacker complete access to the victim’s machine.

“In this specific attack, the cybercriminals also used a blend of other techniques in an attempt to fool anti-malware systems by encrypting the content of the spreadsheet hence hiding the exploit and payload,” researchers told.