Ankura CTIX FLASH Update - July 18, 2023

Malware Activity

"LokiBot" Campaign Identified Exploiting Known Microsoft Office Vulnerabilities

Researchers have identified a new campaign exploiting known vulnerabilities within Microsoft Office documents to deploy the "LokiBot" malware. The vulnerabilities, tracked as CVE-2021-40444 and CVE-2022-30190, are remote code execution (RCE) flaws that allow attackers to "embed malicious macros within Microsoft documents that, when executed, dropped the LokiBot malware onto the victim's system." LokiBot has been active since 2015 and is a well-known information-stealing Trojan that targets Windows devices. In their latest report, researchers explained that two types of Word documents were reviewed from the latest campaign. The first document contained an embedded link within an XML file and initially exploited CVE-2021-40444 and later in the attack chain downloads a file that exploits CVE-2022-30190. The second document contained a VBA script that downloads