Microsoft Excel's standard file encryption capabilities can be used to obfuscate and deliver malware. Mimecast Threat Center researchers have discovered a rise in the LimeRAT malware delivery using Microsoft Excel spreadsheet's VelvetSweatshop default password. This new research demonstrates that making an Excel file read-only — as opposed to locking it — encrypts the file without the need for an external created password to open it, making it easier to fool a victim into installing the malware. How VelvetSweatshop Paved the Way for Malware Delivery Microsoft Office files are some of the most popular file formats for the delivery of email-borne malware. The Microsoft Office applications that can open and run these files are broadly deployed, the files are easy to change to avoid simple file signature-based detection, are macro-enabled to make running custom code easy, and are regularly distributed by consumers and businesspeople via email. Certainly, few are ever surprised to receive invoices or financial spreadsheet attachments via email. However, ease of use and broad deployment have drawbacks. This popularity means that exploiting Excel files has been a part of cybercriminals' standard attack arsenal for a long time, and receiving password-protected Excel files is also a standard business practice, given the interesting or sensitive content. Excel files are designed to be easily encrypted prior to being emailed, which helps attackers evade detection by common malware detection systems. When you lock an Excel file with a password, you are encrypting the entire file using the password as the encryption/decryption key. To open the file, the intended victim would need the same password. When a victim receives an encrypted attachment in a social engineered email, the victim is encouraged to use the password included in the phishing email to open the attached file. Just like that, the victim is owned! But what if attackers could deliver a malicious, encrypted Excel file without requiring the intended victim to do anything other than open the attached file? Skip the part of needing to encourage them to insert the password — slipping through all network defenses. Just a simple double-click of the file would do the trick. To decrypt a given encrypted Excel file, Excel first tries to use the embedded, default password, "VelvetSweatshop," to decrypt and open the file and run any onboard macros or other potentially malicious code, while keeping the file read-only. If it fails to decrypt the file using the "VelvestSweatshop" password, Excel will request that the user insert a password, as shown in Figure 1 below. The advantage of the read-only mode for Excel to the attacker is that it requires no user input, and the Microsoft Office system will not generate any warning dialogs other than noting the file is read-only. Using this read-only technique, the attacker can reap the obfuscation benefits of file encryption without requiring anything further from the user, taking away one step required of the intended victim for exploitation to occur. LimeRAT Malware Exploited in the Wild Recently, Mimecast threat intelligence researchers came across a campaign, which used this Excel VelvetSweatshop encryption technique to deliver LimeRAT, a malicious remote access trojan. In this specific attack, the cybercriminals also used a blend of other techniques in an attempt to fool anti-malware systems by encrypting the content of the spreadsheet hence hiding the exploit and payload. Once LimeRAT has landed, the attacker has many capabilities at his or her fingertips, including delivering ransomware, a cryptominer, a keylogger, or creating a bot client. Of course, given the general capability inherent with this Excel-based malware delivery technique, any type of malware is a good candidate for delivery, so Mimecast researchers expect to see it used in many more malicious phishing campaigns in the future. Mimecast Threat Center has alerted Microsoft to this campaign. How to Defend Your Organization Against Payload Malware Due to the popularity and ease of use of Microsoft Excel spreadsheet, the VelvetSweatshop technique that has risen again to deliver LimeRAT malware will likely prove to be especially dangerous. Follow these steps to mitigate your risk. • Train your users to scrutinize all received emails, particularly those with file attachments. While this attack technique reduced the need for user involvement, it did not eliminate it altogether, as receivers were still required to open the file. • Use an email security system with advanced malware protection capabilities that are designed to include both static file analysis as well as sandboxing to filter out these malicious emails before delivery. • Monitor your network traffic for outbound connections to likely command-and-control services. • Continuously update your endpoint security system to increase the likelihood of detecting malicious software loading or running on the host. Reach out to Mimecast for more information or detail on this research. — The writer is director of Enterprise Security Campaigns at Mimecast
