After Microsoft started blocking macros obtained from the internet by default, email attackers are exploring alternative techniques to distribute Emotet, Qakbot, IcedID and other payloads.
The malware framework contains a loader, dropper and a remote access trojan with its own network communication protocol.
Researchers speculate that the emerging loader is a replacement for the BazaLoader malware.
A recent Emotet campaign with significant TTP changes reveal that attackers may be moving away from macros-based attacks given Microsoft’s recent plans to block VBA macros by default.
The previously discovered RCE flaw in the Spring framework is being leveraged by attackers to deploy the Mirai botnet malware.