Case Study: ServHelper by TA505 with the Help of Macros in Excel 4.0

What are Macros?

Macros are automated scripts or sequences of instructions that simplify repetitive tasks in software applications. In the context of Microsoft Excel, macros enable users to perform tasks like data formatting, calculations, or file manipulations with minimal manual effort. These scripts are written in programming languages like VBA (Visual Basic for Applications) and can be recorded or coded directly, making them a powerful tool for both productivity and exploitation.

What are VBA and VSB & Why Are They Used?

Visual Basic for Applications (VBA) is a programming language embedded in Microsoft Office applications, including Excel, Word, and Access. It allows users to create complex macros that interact with the application’s environment. VSB (Visual Basic Script) is a lightweight scripting language used for automation tasks outside the Office ecosystem.

Both VBA and VSB are used to streamline processes, automate tasks, and create custom functionalities. However, these languages can be exploited by malicious actors to execute harmful scripts, which is a technique prominently used in cyberattacks, including those involving Excel 4.0 macros.

ServHelper Malware by TA505

Overview of ServHelper

ServHelper is a sophisticated malware strain developed and distributed by the infamous cybercrime group TA505. Known for their large-scale campaigns, TA505 has targeted various industries with an emphasis on financial institutions. ServHelper is often delivered through phishing emails that contain malicious Excel files embedded with Excel 4.0 macros.

How Excel 4.0 Macros Play a Role

Excel 4.0 macros are legacy features that allow the execution of commands in cells. Despite being outdated, these macros are still supported in modern Excel versions, making them a popular choice for attackers. TA505 leverages these macros to bypass modern security controls that are less focused on legacy features.

Working Functionality and Architecture of ServHelper

Initial Infection Vector

The attack begins with a phishing email containing a malicious Excel attachment. The document includes Excel 4.0 macros, which execute automatically upon enabling content.

These macros are designed to:

1. Download additional payloads from a remote server.
2. Establish a connection with the command and control (C2) server.

Command and Control (C2) Communication

ServHelper’s architecture heavily relies on C2 communication. Once installed, the malware communicates with its C2 server to:

• Receive instructions.
• Exfiltrate sensitive data.
• Download additional modules for extended functionality.

Key Functional Modules

1. Downloader: Facilitates the retrieval of additional malicious components.
2. RAT Capabilities: Provides remote control over infected systems.
3. Persistence Mechanisms: Ensures the malware remains active even after system reboots.

Mitigation Strategies

Preventive Measures

1. Email Filtering: Implement robust spam filters to block phishing emails.
2. Macro Restrictions: Disable macros by default and use group policies to restrict their execution.
3. Endpoint Protection: Deploy advanced endpoint detection and response (EDR) solutions to identify suspicious behaviors.

By understanding the mechanisms behind TA505’s use of ServHelper and Excel 4.0 macros, organizations can take proactive steps to safeguard their systems. The interplay between legacy features and modern malware underscores the importance of maintaining robust cybersecurity practices.

Helper by TA505 with the Help of Macros in Excel 4.0