AKBuilder AK-2 Exploit Kit

AKBuilder exploits vulnerabilities in Microsoft Office so cyber criminals can deliver malware. The exploit kit is currently on its second version (AK-2).

Threat ID:: CC-1174
Category:: Exploit
Threat Severity:: Low
Threat Vector:: Exploit
Published:: 16 February 2017 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

AKBuilder exploits vulnerabilities in Microsoft Office so cyber criminals can deliver malware. The exploit kit is currently on its second version (AK-2).

Affected platforms

The following platforms are known to be affected:

Microsoft Office

Microsoft Word 2007 SP3
Office 2010 SP2
Word 2010 SP2
Word 2013 SP1
Word 2013 RT SP1
Word for Mac 2011
Office Compatibility Pack SP3
Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1
Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Microsoft Word

Threat details

AKBuilder is built from a Python script which has similar characteristics to banking Trojans such as PredatorPain and NetWiredRC. Due to the simplicity of the Python script, an adversary only has to enter the name of the payload file, name of the decoy document and finally the name of the generated exploit document.

The AK-2 version leverages the vulnerability (CVE-2015-1641) within the affected Microsoft applications listed above. These documents are distributed via email spam campaigns with majority of the activity coming from Nigerian BEC groups. Business Enterprise Compromise (BEC) schemes typically pose as someone influential in an organisation requesting immediate fund transfers, payment notice and wire transfer requests. Financial gain is often the motive behind BEC attacks and it is consistent with the fact that banking Trojans are the main form of malware that gets distributed.

Remediation steps

Type	Step
	A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails. All operating systems, antivirus and other security products are kept up to date. All day to day computer activities such as email and internet are performed using non-administrative accounts. Strong password policies are in place and password reuse is discouraged. Network, proxy and firewall logs should be monitored for suspicious activity.

Type

Step

A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
All operating systems, antivirus and other security products are kept up to date.
All day to day computer activities such as email and internet are performed using non-administrative accounts.
Strong password policies are in place and password reuse is discouraged.
Network, proxy and firewall logs should be monitored for suspicious activity.

CVE Vulnerabilities

Status

CVE-2015-1641

Last edited: 17 February 2020 11:25 am