Ukraine Warns of Weaponized XLL Files Delivers CABINETRAT Malware Via Zip Files
Ukrainian security agencies have issued an urgent notification concerning a sophisticated malware campaign targeting government and critical infrastructure sectors through weaponized XLL files distributed via compressed archives.
Ukrainian security agencies have issued an urgent notification concerning a sophisticated malware campaign targeting government and critical infrastructure sectors through weaponized XLL files distributed via compressed archives.
The campaign leverages Microsoft Excel add-in files containing the CABINETRAT backdoor, marking a significant advancement in targeted cyber operations against Ukrainian entities.
The attack involves distributing zip archives with XLL files, given names that suggest urgency and legitimacy, such as "dodatok.xll" within "500.zip" archives. These files impersonate documents related to border security incidents, exploiting current geopolitical tensions to increase victim susceptibility.
Upon execution, the malicious XLL files deploy a complex multi-stage payload establishing persistent access to compromised systems. CERT-UA researchers identified the campaign's sophisticated approach, associating it with threat group UAC-0245.
The malware demonstrates advanced evasion capabilities, indicating a shift towards more sophisticated Office-based attack vectors targeting Ukrainian critical infrastructure. The campaign's technical complexity and targeting patterns suggest state-sponsored origins with substantial resources dedicated to bypassing modern security defenses.
These files impersonate documents related to border security incidents, exploiting current geopolitical tensions to increase victim susceptibility.
Infection Mechanism and Persistence Strategy
The CABINETRAT malware employs a sophisticated multi-file deployment strategy ensuring persistent system access while evading detection mechanisms. When the initial XLL file executes through Excel's xlAutoOpen function, it creates three distinct components across the victim system:
A randomly named executable file ("runner.exe") placed in both the Startup folder and %APPDATA%\Microsoft\Office\ An XLL loader file "BasicExcelMath.xll" in Excel's XLSTART directory A PNG image file "Office.png" containing embedded shellcode
The persistence mechanism operates through multiple redundant pathways to ensure continued system access. The malware creates registry entries in the Windows Run key with randomized names, establishes scheduled tasks executing every 12 hours with limited privileges, and leverages Excel's automatic add-in loading functionality.
The runner executable launches Excel in hidden mode using the "/embed" parameter, automatically triggering the malicious BasicExcelMath.xll add-in without displaying visible Excel windows to users. The complete infection chain progresses from initial XLL execution to final CABINETRAT deployment.
The malware incorporates extensive anti-analysis measures, including BIOS fingerprinting checks for virtualization software signatures, processor core and memory threshold validation, CPUID timing analysis to detect sandboxed environments, and PEB debugging flag verification. These sophisticated evasion techniques highlight the campaign's advanced nature and dedication to avoiding security research efforts.
Based on reporting by Cyber Security News.