Dutch authorities this week announced the arrest a 20-year old man for allegedly developing and distributing Office Macro Builders.
Such programs are designed to allow cybercriminals weaponize Office documents to deliver malicious payloads via obfuscated macro code. The macro might also purposely attempt to bypass endpoint security defenses.
Once the document containing such a malicious macro is opened, the code would be executed, which could surreptitiously download malware or start a program on the device.
The arrested individual, a resident of the Dutch city of Utrecht, is said to have created and distributed toolkits named Rubella, Cetan and Dryad. Aided by McAfee and another private company, the Dutch authorities managed to trace various online handles on hacking forums to the man.
According to the authorities, the suspect sold the macro builder Rubella for prices ranging from a couple of hundred to thousands of euros. According to McAfee, Dryad and Rubella are very similar, and a conversation with the suspect revealed that the individual was behind both of them.
The man was also “found in possession of data concerning dozens of credit cards and manuals on carding, a type of credit card fraud,” the Dutch authorities reveal. Moreover, the suspect had in possession access credentials for thousands of websites.
The man reportedly collected around 20,000 Euro (around $22,000) in crypto currency such as Bitcoins.
“Toolkits that build weaponized Office documents, like Dryad and Rubella, cater to the increasing cybercriminal demand of this type of infection vector. With the arrest of the suspect comes an end to the era of Dryad and Rubella Macro Builder,” McAfee notes.
Related: Macro-Based Multi-Stage Attack Delivers Password Stealer
Related: Macro Malware Comes to macOS
More from Ionut Arghire
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- Latitude Financial Services Data Breach Impacts 300,000 Customers
- US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- New ‘Trigona’ Ransomware Targets US, Europe, Australia
- New Espionage Group ‘YoroTrooper’ Targeting Entities in European, CIS Countries
- CISA Seeks Public Opinion on Cloud Application Security Guidance
Latest News
- Ferrari Says Ransomware Attack Exposed Customer Data
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
