CampaignPublished 7 Jun 2018Updated 2 Jul 2025

tlp white · New Phishing Attacks Abuse Excel Internet Query Files

Affects tlp whiteSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

New Phishing Attacks Abuse Excel Internet Query Files

Impact

For European organizations, this phishing technique poses significant risks primarily through social engineering and subsequent malware infection or credential compromise. The automatic data retrieval feature in Excel IQY files can be abused to download malicious scripts or payloads, potentially leading to unauthorized access, data exfiltration, or lateral movement within corporate networks. Organizations with a high reliance on Microsoft Office products and Excel for data analysis and reporting are particularly vulnerable. The campaign’s association with the Necurs botnet suggests potential for widespread distribution, increasing the likelihood of targeted attacks against European enterprises. The impact includes potential disruption of business operations, financial loss due to fraud or ransomware, and reputational damage. Since the attack vector involves user interaction, organizations with insufficient user awareness training or weak email filtering controls are at higher risk. Additionally, sectors with sensitive data such as finance, healthcare, and government institutions in Europe could face elevated threats due to the value of their information and strategic importance.

Defensive guidance

To mitigate this threat effectively, European organizations should implement a multi-layered defense strategy beyond generic advice: 1) Enhance email filtering to detect and quarantine emails containing IQY files or suspicious Excel attachments, using advanced heuristics and sandboxing to analyze attachment behavior. 2) Configure Microsoft Office security settings to disable or restrict automatic external data connections in Excel, preventing IQY files from fetching data without explicit user consent. 3) Conduct targeted user awareness training focusing on the risks of opening unsolicited Excel attachments and recognizing phishing attempts that use legitimate file types for malicious purposes. 4) Employ endpoint detection and response (EDR) solutions capable of identifying unusual Excel network activity or script execution triggered by IQY files. 5) Maintain strict network segmentation and monitor outbound traffic for unusual connections to unknown external servers, which may indicate IQY file exploitation. 6) Implement application whitelisting to restrict execution of unauthorized scripts or macros initiated by Excel. 7) Regularly update threat intelligence feeds and integrate indicators of compromise related to Necurs and similar campaigns into security monitoring tools. These targeted controls will reduce the attack surface and improve detection and response capabilities against this specific phishing vector.

Indicators of compromise

Domains 1

DomainTools Risk Score 100

clodflarechk.com

URLs 4

Once the victim double-clicks the attachment, it downloads a file named "2.dat" from clodflarechk[.]com. 2.dat is a Powershell script that downloads a file named "1.dat" from the same network resource. 1.dat is another script file that downloads a file named "data.xls" from the same network resource. Although the extension is ".xls," it is not an Excel file but rather an executable file that functions as a malware downloader. Once executed on the system, data.xls downloads a file named "cloud.png" from the same network resource. Cloud.png is not a graphic file as the extension suggests, but rather it is the main malware installed on the system. The main malware functions as a remote access Trojan (RAT) that gives attackers control of the compromised system.

http://clodflarechk.com/1.dat
http://clodflarechk.com/cloud.png
http://clodflarechk.com/2.dat
http://clodflarechk.com/data.xls

IP addresses 2

clodflarechk

85.119.150.29
103.208.86.69

Hashes 5

08bb85f5bff52d2605ddd8a19a5465fd
418aa2d43b1e4a841d4769463b12fa3b
d2a63814440f8d054d78b03b48f7a3df
3a86ffce06d029730ad89cb233079d64
172bc98dbe0f6c4ac59857c071cd8673

Link 1

https://myonlinesecurity.co.uk/necurs-delivering-flawed-ammy-rat-via-iqy-excel-web-query-files/

Community reviews

Loading reviews…