Ankura CTIX FLASH Update - January 24, 2023

Ransomware/Malware Activity

Recent Uptick in Malicious Microsoft OneNote Attachments Identified in Phishing Campaigns

Security researchers have noted a recent uptick in phishing campaigns utilizing Microsoft OneNote attachments to spread malware. Phishing emails typically contain Microsoft Word documents or Excel files that are embedded with malicious macros as well as ISO images or password-protected ZIP files. With Microsoft disabling default macros, threat actors have turned to OneNote, the digital notebook application included by default in Microsoft Office 2019 and Microsoft 365, which can be used to open the OneNote file format despite not being used by the user. In December 2022, Trustwave SpiderLabs researchers noted actors leveraging Microsoft OneNote documents to spread the "Formbook" malware, an information-stealing trojan sold as malware-as-a-service since mid-2016. Once the attachment was opened, a large "View Document" image was shown over