Security News > 2022 > September > Hackers Using PowerPoint Mouseover Trick to Infect Systems with Malware

The Russian state-sponsored threat actor known as APT28 has been found leveraging a new code execution method that makes use of mouse movement in decoy Microsoft PowerPoint documents to deploy malware.

"The code execution runs a PowerShell script that downloads and executes a dropper from OneDrive."

The dropper, a seemingly harmless image file, functions as a pathway for a follow-on payload, a variant of a malware known as Graphite, which uses the Microsoft Graph API and OneDrive for command-and-control communications for retrieving additional payloads.

The attack employs a lure document that makes use of a template potentially linked to the Organisation for Economic Co-operation and Development, a Paris-based intergovernmental entity.

Cluster25 noted the attacks may be ongoing, considering that the URLs used in the attacks appeared active in August and September, although the hackers had previously laid the groundwork for the campaign between January and February.

In January 2022, Trellix disclosed a similar attack chain that exploited the MSHTML remote code execution vulnerability to drop the backdoor.

News URL

https://thehackernews.com/2022/09/hackers-using-powerpoint-mouseover.html