TA558 is exploiting Microsoft Word, affecting hundreds of companies globally

Ensure you have the latest Microsoft Office version installed on your computer

2 min. read

Published onApril 17, 2024

published onApril 17, 2024

Share this article

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Researchers from Positive Technologiesdiscovered a campaign known as SteganoArmor, in which hackers were using steganography to target hundreds of organizations in Latin America with remote access trojans (RAT), infostealers, and more.

Hackers use steganography, an obfuscation method, to hide data like malware inside benign files; therefore, email security solutions are not able to flag these files.

Researchers said a threat actor dubbed TA558 sent hundreds of phishing emails containing Microsoft Word and Excel files.

These files exploit a seven-year-old flaw tracked as CVE-2017-1182. To avoid the chances of the emails being flagged by email security solutions, cybercriminals send emails using compromised SMTP servers.

Once the affected person runs the file, a Visual Basic Script from the legitpaste upon opening the file.eeservice is downloaded. The script will also download a JPG file holding a base-64 encoded payload.

Then, the payload will download and install any of the malware variants:

The target was the entire world, but the organization in Latin America was most affected. More than 320 attacks have been discovered so far.

To avoid becoming the target of such attacks, you must always pay attention to the emails you open and the files you download. Don’t open the email if you don’t recognize the sender or find anything suspicious in your inbox. Also, ensure you have the recent version of Microsoft Office installed on your device.

Have you been a victim of a phishing attack? If so, share your experience with our readers in the comments section below.

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low#

Copilot in Outlook will generate personalized themes for you to customize the app#

Microsoft will raise the price of its 365 Suite to include AI capabilities#

Death Stranding Director’s Cut is now Xbox X|S at a huge discount#

Outlook will let users create custom account icons so they can tell their accounts apart easier#

TA558 is exploiting Microsoft Word, affecting hundreds of companies globally#

With KB5043178 to Release Preview Channel, Microsoft advises Windows 11 users to plug in when the battery is low

Copilot in Outlook will generate personalized themes for you to customize the app

Microsoft will raise the price of its 365 Suite to include AI capabilities

Death Stranding Director’s Cut is now Xbox X|S at a huge discount

Outlook will let users create custom account icons so they can tell their accounts apart easier

TA558 is exploiting Microsoft Word, affecting hundreds of companies globally