Menu
Microsoft Word exploit linked to cyberspying in Ukraine conflict

Microsoft Word exploit linked to cyberspying in Ukraine conflict

The attack appears to have occurred in January, before Microsoft became aware of the flaw

A previously unknown Microsoft Office vulnerability was recently used to deliver spyware to Russian-speaking targets, in a possible case of cyberespionage.

Security firm FireEye noticed the intrusion attempt, which taps a critical software flaw that hackers are using to craft malicious Microsoft Word documents.

On Wednesday, FireEye said it uncovered one attack that weaponized a Russian military training manual. Once opened, the malicious document will deliver FinSpy, a surveillance software that’s been marketed to governments.

It’s unclear who the document was targeting. However, it appears to have been published in the Donetsk People’s Republic, a breakaway region in Ukraine that’s received Russian support.

FinSpy, also known as FinFisher, is developed by a subsidiary of Gamma Group, a European firm that specializes in surveillance and monitoring equipment. Thirty-three governments have been suspected of using the firm's spyware, according to a 2015 investigation from Citizen Lab.

FireEye said the malicious Russian training manual can download additional malware payloads to the victim’s computer, along with another fake document claiming to be a Russian decree approving a forest management plan.

The attack appears to have occurred this January, months before Microsoft became aware of the vulnerability. Given that Gamma Group probably has a long list of government customers, FireEye suspects other parties may have hacked targets in the same way, using FinSpy.

It’s also possible that knowledge about the Microsoft vulnerability may have been circulated in the hacking community.

In March, a separate attack was found using the vulnerability but instead to deliver malware that’s been involved in financial crimes.

However, FireEye said that both this attack and the intrusion attempt against Russian-speaking targets share similar code. This suggests different hacking groups may have gotten information about Microsoft vulnerability from the same source.

Fortunately, Microsoft on Tuesday issued a patch to fix the flaw. Security researchers warn that opening email attachments remain a major source of malware infections.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments