State-backed hackers increasingly use RTF injection for phishing

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/state-backed-hackers-increasingly-use-rtf-injection-for-phishing/

Three APT hacking groups from India, Russia, and China, were observed using a novel RTF (rich text format) template injection technique in their recent phishing campaigns. This technique is a simple yet effective method to retrieve malicious content from a remote URL, and threat analysts expect it to reach a wider audience of threat actors soon.
Researchers at Proofpoint spotted the first cases of weaponized RTF template injection in March 2021, and since then, actors have been steadily optimizing the technique.

"The viability of XML Office based remote template documents has proven that this type of delivery mechanism is a durable and effective method when paired with phishing as an initial delivery vector," explained Proofpoint in their report.
"While this method currently is used by a limited number of APT actors with a range of sophistication, the technique's effectiveness combined with its ease of use is likely to drive its adoption further across the threat landscape."

State-backed hackers increasingly use RTF injection for phishing

Three APT hacking groups from India, Russia, and China, were observed using a novel RTF (rich text format) template injection technique in their recent phishing campaigns.

www.bleepingcomputer.com

 

[Andy Ful]

I have seen a few samples for example:
https://app.any.run/tasks/86fe91e2-0a28-4736-9032-b3e7593045e4/
https://app.any.run/tasks/ccb4a060-e315-4735-9820-d331e59ee6d1/

In these examples, the RTF template injection was used to deliver a payload, and an additional MS Office exploit (CVE-2017-11882, patched in November 2017) was used to execute the malicious code.

 

[LASER_oneXM]

Hackers are turning to this simple technique to install their malware on PCs

Cybersecurity researchers warn about hacking groups increasingly using a simple technique that seems to work.

www.zdnet.com

Nation state-backed hacking groups are exploiting a simple but effective new technique to power phishing campaigns for spreading malware and stealing information that's of interest to their governments.

Cybersecurity researchers at Proofpoint say advanced persistent threat (APT) groups working on behalf of Russian, Chinese and Indian interests are using rich text format (RTF) template injections.