Smoking Can Be Bad For Your Computer

Opening a Word attachment that is infected with a recent find by Cisco Talos researchers may be hazardous to your health. They have been tracking a new version of a malicious application that is used to get other malware onto devices called Smoke Loader. It can affect anyone; not just those who enjoy a smoke once in a while. Not only was it bad to begin with when it was first found in 2011, but now it is new and improved, and of course more dangerous. You knew I was going to say that, didn’t you?

Smoke Loader spreads via email messages using malicious Microsoft Word documents and a macro. If an attachment is unexpected, don’t open it. If it includes a macro that you are not 100% sure is safe, don’t activate it. In fact, unless you created it, you should keep macros disabled by default.

Having antivirus installed on all devices is always great advice. In the case of this new version it successfully loads using something the researchers called PROPagate. It injects code that corrupts graphical user interfaces (GUI), which is the new and improved part of Smoke Loader. GUIs are visual indicators that allow users to interact with icons and other visual cues, as opposed to using text only. Many antivirus products blocked this version of Smoke Loader with great success. So, make sure to keep those products updated too.

Smoke Loader’s primary goal is to deliver ransomware and cryptominers onto victim devices. There are other objectives as well, such as stealing stored login credentials or other sensitive information that is transferred via browsers. One of its preferred payloads is to steal banking credentials. From what we know, the phishing emails that distributed this malware are designed to look like legitimate invoices or purchase orders from firms with which many would typically do business.

It also has been known to infiltrate applications such as Team Viewer. That allows it to possibly collect credentials of others on the same network.

It pays to spend some time performing awareness training of all employees and staff on how to avoid phishing and steps to take if they accidentally click on malicious links or attachments.

Stickley on Security
Published September 19, 2018