New ‘NotDoor’ Malware Targets Outlook Users for Data Theft and System Compromise

Russian state-sponsored hackers have developed a new backdoor malware named "NotDoor" targeting Microsoft Outlook users. This malware enables attackers to steal sensitive data and gain control over compromised systems.

Attribution of the NotDoor malware is to APT28, a Russian cyber-espionage group known as Fancy Bear. This group is linked to Russia's General Staff Main Intelligence Directorate (GRU) and is responsible for various high-profile cyberattacks.

The malware's discovery was reported by LAB52, a threat intelligence unit of Spanish cybersecurity firm S2 Grupo, highlighting the group's continuous adaptation to bypass modern defense mechanisms.

NotDoor is a malware written in Visual Basic for Applications (VBA), used to automate tasks within Microsoft Office applications. It demonstrates sophistication in compromising Outlook users by monitoring incoming emails for specific trigger words, such as "Daily Report." Upon detection, the malware activates, allowing the execution of malicious commands on the system.

The name "NotDoor" originates from the frequent use of the word "Nothing" within the malware's code. It employs several advanced techniques to avoid detection:

Code Obfuscation: The malware's code is scrambled with randomized variable names and custom encoding methods, complicating analysis for researchers. DLL Side-Loading: It exploits a legitimate Microsoft binary, OneDrive.exe, to load malicious DLL files, making the malware appear trusted. Registry Modification: It alters Outlook's registry settings to disable security warnings about macros, allowing silent operation.

NotDoor uses event-driven VBA triggers to maintain persistence and remain hidden. Once active, it creates a hidden directory to store temporary files, which are exfiltrated to an attacker-controlled email before deletion. Successful execution is confirmed by sending callbacks to a webhook site.

S2 Grupo's analysis indicates that NotDoor has compromised multiple companies across various sectors in NATO member countries, demonstrating the malware's effectiveness and strategic targeting of Western organizations.

Security experts recommend disabling macros by default and monitoring for unusual activity within Outlook applications to protect against NotDoor attacks.

The emergence of NotDoor represents an escalation in APT28's cyber warfare capabilities, showcasing the group's ability to develop sophisticated tools for espionage and system compromise.

Based on reporting by GBHackers.