Skip to main content
عربي
logo

NCSC-TAD-2112-001

Severity Level: Critical
Malware

Reference No.: NCSC-TAD-2112-001CVSS 0

WIRTE Campaign Targets Middle East Entities

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

A threat group known as WIRTE targets several entities in the Middle East by sending phishing emails containing malicious Excel/Word documents. The Excel droppers use Excel 4.0 macros to generate a VBS script with embedded PowerShell code to download payloads and receive commands from command-and-control servers. The attackers collect system information, identify installed antivirus software, check administrative privileges, and take screenshots. Cloudflare is used to disguise the IP addresses of their

Affected Technologies

  • Microsoft Office Word and Excel
  • Excel 4.0 macros
  • VBS and PowerShell

Mitigation and Immediate Actions

  1. 01

    Email content filtering. Whitelist allowed attachment types (including archives and nested archives). Analyse/sanitize hyperlinks, PDF, and Microsoft Office attachments. Quarantine Microsoft Office macros.

  2. 02

    Application whitelisting of approved/trusted programs to prevent execution of unapproved/malicious programs including .exe, DLL, scripts.

  3. 03

    User application hardening. Configure web browsers to block Flash (ideally uninstall it), ads, and Java on the Internet.

  4. 04

    Web content filtering. Whitelist allowed types of web content and websites with good reputation ratings. Block access to malicious domains and IP addresses, ads, anonymity networks, and free domains.

  5. 05

    Protect your workstations and servers. We continue to encourage customers to follow our Protect Your Computer guidance of enabling a firewall, getting software updates, and installing antivirus software.

References