RTF Design, Office Flaw Exploited in Multi-Stage Document Attack

A newly discovered multi-stage document attack exploits design behaviors in .docx and RTF, along with CVE-2017-8570, to drop a malicious payload called Formbook on target endpoints. Attackers bypass traditional security tools with embedded URLs instead of active code.

Researchers at Menlo Security Labs who isolated the second-stage document say the behaviors enabling this attack are not new, but that this threat demonstrates an increasingly common way for hackers to slip past security defenses by relying on remotely hosted malicious objects.

"What we discovered is a new way in which Windows is getting the second-stage payload," says Vinay Pidathala, Menlo's director of security research. "There's absolutely no macros, no shellcode being used, just a URL. When the victim opens the document, it will go and fetch the remotely hosted components and load it in the context of the Word process."

The first stage of this attack is a phishing email with a malicious .docx file attached. The file does not have any macros, nor does it use any exploits, and embedded in its frame section is the URL. If the doc is opened, Word makes an HTTP request to download the remote object the URL is pointing to, which in this case redirects to another URL that points to a malicious RTF file.

Attackers are abusing capabilities in Microsoft Word that were more commonly used when it was an HTML editor, says Pidathala. Nobody uses Word to edit HTML anymore, he says, but those functions and API calls still exist and threat actors are taking advantage of them.

The RTF file contains an embedded script and another exploit, he continues. It marks stage two of the attack, which abuses both a design behavior in RTF documents and the CVE-2017-8570 vulnerability. When an RTF document with an embedded objected is opened, the object is automatically dropped into the %TEMP% directory of Windows.

"This is a well-documented design behavior, but we're seeing these getting abused by attackers now," he points out.

Half of the attack is achieved by dropping the malicious component on the endpoint, but it needs to be executed in order to fully compromise the machine. CVE-2017-8750 does this by executing the object to complete the attack and drop the Formbook malware.

Formbook, the final payload in this scenario, is a commercially available malware capable of taking screenshots, stealing personally identifiable information, keylogging, and downloading additional components if and when it needs to. Menlo researchers believe this is the first time Formbook has been delivered in this specific way.

While it's not a complete banking Trojan, Pidathala points out that it does have a banking component built into it. Full banking Trojans are solely built for stealing banking credentials; he describes this as "more like a RAT that has a lot of functionalities built into it."

This attack signifies a broader trend of threat actors leveraging remotely hosted objects to sneak past security defenses. In 2017, there were many zero-day exploits capable of fetching remote objects from the Internet and exploiting them in the context of Word, which researchers say was the only Office application used for this attack.

Now, attackers have begun to chain exploits with design behaviors to call remotely hosted malicious objects and run them without raising any red flags to the victim.

"All they have to do is open the first-stage document and that's pretty much it," says Pidathala, emphasizing the lack of user interaction needed to successfully launch the attack. "From there, they don't have to click anything or interact with the malicious document in any way."

It's difficult to tell an attack is taking place. "They're not able to identify anything malicious about it because all there is, is a reference to an external URL," says Menlo CTO Kowsik Guruswamy. "Technically it's not malicious; it's just a URL that happens to follow through with all the second- and third-stage droppers."

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.