FIN7 Hackers Using ‘Windows 11 Alpha’ Themed Malicious Documents to Drop JavaScript Backdoor

In a recent wave of the spear-phishing campaign, the FIN7 cybercrime group employed Windows 11 Alpha-themed weaponized word documents to deliver a JavaScript payload with a JavaScript backdoor. 

‘Phishing Email Campaign’ is the initial attack vector, posing as ‘Windows 11 Alpha’, it contains an infected Microsoft Word document (.doc). The virus is accompanied by this image which convinces a user to click on ‘Enable Editing’ and further advance towards the installation process. Once the user enables the content, the VBA macro that is contained in the image begins to come into effect. 

VBA macro is populated with junk data such as comments, it is a common strategy employed by criminals to impede analysis. Once the junk data is being pulled out, all we would be left with is a ‘VBA macro’. Upon further analyzing the JavaScript, researchers learned that it contained obfuscated strings along with a deobfuscation function. 

Researchers have found that the threat actors behind the malicious campaign – upon detecting languages of certain countries including Russia, Slovenia, Serbia, Estonia, and Ukraine – call into action the ‘me2XKr’ function to delete all the tables and then stops running. They do so in order to prevent execution in the aforementioned countries. 

Primarily targeting the U.S.-based telecommunications, education, retail, finance, and hospitality sectors via meticulously crafted attacks, FIN7 has managed to stay ahead of law enforcement by employing novel and advanced techniques to thwart de

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

Read the original article: FIN7 Hackers Using ‘Windows 11 Alpha’ Themed Malicious Documents to Drop JavaScript Backdoor