MaliciousMacroGenerator

Utilitaire de Générateur de Macro Malveillante Utilitaire simple conçu pour générer des macros obscurcies qui incluent également un mécanisme d'échappement aux AV / Sandboxes. Prérequis root@kitploit: Python 2.7 Utilisation root@kitploit: MMG.Malicious Macro Generator v2.0 - RingZer0 Team Auteur ...

PackMyPayload

PackMyPayload — Угроза малвари в контейнерах Перейти к поддерживаемым форматам Этот инструмент принимает на вход файл или директорию и встраивает их в выходной файл, выступающий в роли архива/контейнера. Он может служить Proof‑of‑Concept для демонстрации растущей угрозы контейнерных форматов файл...

BadAssMacros

BadAssMacros الوصف أداة إثبات مفهوم لإنشاء ماكروات ضارة تستخدم تقنيات مثل تنقية VBA VBA Purging وإخفاء شيل كود Shellcode Obfuscation لتجنب محركات مكافحة الفيروسات. تأخذ هذه الأداة شيل كود خام يمكن إنشاؤه بواسطة أطر عمل C2 الشائعة مثل Metasploit, Cobalt Strike إلخ وتخرج ماكرو VBA. تأخذ الأداة ملف...

wePWNise

wePWNise wePWNise هو نص برمجي بمثابة إثبات للمفهوم مكتوب بلغة Python، يقوم بتوليد كود VBA يمكن استخدامه في ماكرو أو قوالب Office. تم تصميمه مع مراعاة الأتمتة والتكامل، ويستهدف سيناريوهات البيئات المقيدة. يقوم الأداة بتعداد سياسات تقييد البرامج SRPs وتخفيفات EMET، وتحديد ديناميكي للتطبيقات الآمنة...

oletools

python-oletools oletools is a package of python tools to analyze Microsoft OLE2 files also called Structured Storage, Compound File Binary Format or Compound Document File Format, such as Microsoft Office 97-2003 documents, MSI files or Outlook messages, mainly for malware analysis, forensics and...

SauronEye

SauronEye SauronEye est un outil de recherche conçu pour aider les équipes rouges à trouver des fichiers contenant des mots-clés spécifiques. Fonctionnalités : Rechercher sur plusieurs disques réseau Rechercher dans le contenu des fichiers Rechercher dans le contenu des fichiers Microsoft Office...

Iran-Linked RedKitten Cyber Campaign Targets Human Rights NGOs and Activists

A Farsi-speaking threat actor aligned with Iranian state interests is suspected to be behind a new campaign targeting non-governmental organizations and individuals involved in documenting recent human rights abuses. The activity, observed by HarfangLab in January 2026, has been codenamed...

Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries

The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor "is a VBA macro for Outlook designed to monitor incoming emails for a...

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Cisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called "MacroPack." MacroPack is a framework designated for Red Team exercises, but w...

OfflRouter Malware Evades Detection in Ukraine for Almost a Decade

Select Ukrainian government networks have remained infected with a malware called OfflRouter since 2015. Cisco Talos said its findings are based on an analysis of over 100 confidential documents that were infected with the VBA macro virus and uploaded to the VirusTotal malware scanning platform...

PicassoLoader Malware Used in Ongoing Attacks on Ukraine and Poland

Government entities, military organizations, and civilian users in Ukraine and Poland have been targeted as part of a series of campaigns designed to steal sensitive data and gain persistent remote access to the infected systems. The intrusion set, which stretches from April 2022 to July 2023,...

Iranian OilRig Group Strikes with AutoHotkey Keylogger and Malicious Macro

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In a recent intrusion, a threat actor utilized AutoHotkey to launch a keylogger. The Iranian OilRig group is suspected to be the culprit behind this attack. The initial compromise was initiated with a...

Amadey Bot Spotted Deploying LockBit 3.0 Ransomware on Hacked Machines

The Amadey malware is being used to deploy LockBit 3.0 ransomware on compromised systems, researchers have warned. "Amadey bot, the malware that is used to install LockBit, is being distributed through two methods: one using a malicious Word document file, and the other using an executable that...

September 6, 2022, update for Office 2013 (KB5002252)

September 6, 2022, update for Office 2013 KB5002252 This article describes update 5002252 for Microsoft Office 2013 that was released on September 6, 2022. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsof...

ALERT: North Korean hackers targeting South Korea with RokRat Trojan

A North Korean hacking group has been found deploying the RokRat Trojan in a new spear-phishing campaign targeting the South Korean government. Attributing the attack to APT37 aka Starcruft, Ricochet Chollima, or Reaper, Malwarebytes said it identified a malicious document last December that, whe...

Purgalicious VBA: Macro Obfuscation With VBA Purging

Malicious Office documents remain a favorite technique for every type of threat actor, from red teamers to FIN groups to APTs. In this blog post, we will discuss "VBA Purging", a technique we have increasingly observed in the wild and that was first publicly documented by Didier Stevens in Februa...

Phishing Emails Used to Deploy KONNI Malware

Summary This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework. See the ATT&CK for Enterprise framework for all referenced threat actor techniques. The Cybersecurity and Infrastructure Security Agency CISA has observed cyber actors using emails containi...

ezEmu - Simple Execution Of Commands For Defensive Tuning/Research

ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

Microsoft Outlook Users Targeted By Gamaredon's New VBA Macro

The Gamaredon threat group has given its post-compromise toolset a facelift with the addition of a new Visual Basic for Applications VBA macro. The VBA macro leverages compromised victims’ Microsoft Outlook email accounts to send spear-phishing emails to their contacts – rapidly widening the...

TAU Threat Analysis: Hakbit Ransomware

The bad actors behind Hakbit ransomware recently released an updated variant of their ransomware, which encrypts the victim’s data and demands 3 Bitcoins in ransom payment. This updated variant is delivered via phishing email as a malicious Excel document, and contains added functionality from th...