APT Groups Exploiting Known Vulnerability in Microsoft Office

This vulnerability continues to be exploited due to the large amount of unpatched software still in use. A successful exploit of this vulnerability will allow an attacker to remotely execute code and escalate privileges on the compromised system.

Attackers are using phishing emails to spread Microsoft Office Rich Text Format (RTF) documents containing the malicious payload. Once the user opens the attached Word document, a HTTP request is issued to a remote server to retrieve a malicious HTML Application (HTA). Once the payload is downloaded, the malicious script displays decoy documents to the user in order to hide the malicious activity from the user.

Anti-virus signature scans should pick up this malware and block it. However, it’s not unusual for attackers to modify the signature to avoid detection. Users and administrators are urged to apply the patch from Microsoft as soon as possible.