Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The backdoor is deployed via Microsoft OneDrive.exe using DLL side-loading, and it establishes persistence by modifying registry keys. NotDoor employs obfuscation techniques and a custom string encoding method. It can execute commands, exfiltrate files, and upload files to the victim's machine. The malware demonstrates APT28's continuous evolution in bypassing defense mechanisms, posing a significant threat to NATO member countries across various sectors.

NotDoor is a newly identified backdoor malware attributed to APT28, a Russian intelligence-linked advanced persistent threat group known for targeting government, military, and strategic sectors. This backdoor is implemented as a VBA macro embedded within Microsoft Outlook, which monitors incoming emails for specific trigger words to activate its malicious capabilities. Once triggered, NotDoor enables a range of offensive actions including data exfiltration, file uploads to the victim machine, and arbitrary command execution. The malware leverages DLL side-loading via the legitimate Microsoft OneDrive.exe process to execute its payload, a technique that helps it evade detection by blending with trusted system processes. Persistence is established through modifications to Windows registry keys, ensuring the malware remains active across system reboots. NotDoor also employs multiple obfuscation techniques and a custom string encoding method to hinder analysis and detection. The malware's capabilities include executing commands remotely, exfiltrating sensitive files, and uploading files onto compromised systems. This evolution in APT28's toolkit demonstrates their ongoing efforts to bypass modern defense mechanisms and maintain stealthy access to targeted networks. The threat is particularly concerning for NATO member countries, as APT28 has historically focused on espionage and disruption campaigns against Western military and governmental organizations. The campaign does not currently have known exploits in the wild but represents a medium-severity threat due to its sophisticated evasion and persistence techniques combined with its potential impact on confidentiality and integrity of sensitive information.

Detailed information about Analyzing NotDoor: Inside APT28's Expanding Arsenal. Get real-time updates, technical details, and mitigation strategies.

Analyzing NotDoor: Inside APT28's Expanding Arsenal - Live Threat Intelligence - Threat Radar | OffSeq.com

Analyzing NotDoor: Inside APT28's Expanding Arsenal

An Iran-nexus spear-phishing campaign masquerading as the Omani Ministry of Foreign Affairs targeted global governments in August 2025. Attributed to Iranian-aligned operators linked to the Homeland Justice group and MOIS, the campaign used compromised mailboxes to send emails with malicious Microsoft Word attachments. The documents contained VBA macros that decoded and deployed malware payloads. The multi-wave operation targeted diplomatic and governmental entities across multiple regions, including the Middle East, Africa, Europe, Asia, and the Americas. The campaign utilized social engineering lures, anti-analysis techniques, and a reconnaissance-focused malware called sysProcUpdate. The attackers aimed to gain initial access, map internal networks, and prepare for further exploitation in diplomatic and industrial organizations.

This threat describes a sophisticated spear-phishing campaign attributed to Iranian-aligned threat actors linked to the Homeland Justice group and Iran's Ministry of Intelligence and Security (MOIS). The campaign, active in August 2025, impersonated the Omani Ministry of Foreign Affairs to target diplomatic and governmental entities worldwide, including Europe. Attackers leveraged compromised legitimate mailboxes to send malicious emails containing Microsoft Word documents with embedded VBA macros. When macros are enabled by the recipient, they decode and deploy a reconnaissance-focused malware named sysProcUpdate. This malware is designed to gather detailed information about the infected system and network environment, including internal network mapping and credential harvesting, to facilitate further exploitation. The campaign employed multiple waves and utilized social engineering lures tailored to diplomatic targets, anti-analysis techniques to evade detection, and a broad set of tactics, techniques, and procedures (TTPs) such as process injection, persistence mechanisms, credential dumping, and command and control communications. Indicators of compromise include multiple file hashes and a malicious domain (screenai.online). The operation's goal is initial access and reconnaissance within high-value diplomatic and industrial organizations, preparing for potential follow-on attacks or espionage activities.

Detailed information about CTI Analysis: Malicious Email Campaign. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'vba macro'

Filter Threats

Threats Tagged 'vba macro'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility