NotDoor Malware

Fancy Bear deployed NotDoor, a VBA macro-based Outlook backdoor that uses DLL side-loading of a signed OneDrive.exe to install malicious macros, achieve persistence via registry modifications, and trigger on specific email strings to exfiltrate data and execute commands. The campaign targets NATO-country organizations and uses custom obfuscation, Base64 and randomized prefixes, and network checks (nslookup and curl to webhook.site) to verify deployment. #NotDoor #FancyBear

Keypoints

NotDoor is a VBA macro Outlook backdoor deployed by Fancy Bear (APT28) that targets organizations in NATO member countries.
Infection uses DLL side-loading of a legitimate signed Microsoft OneDrive.exe to load a malicious SSPICLI.dll which copies a payload to %APPDATA%MicrosoftOutlookVbaProject.OTM.
Persistence and reduced user detection are achieved by modifying registry keys to enable macros and disable Outlook security prompts under SoftwareMicrosoftOffice16.0OutlookSecurity.
The backdoor activates via email triggers (e.g., “Daily Report”), parsing emails for encoded commands and an exfiltration address using a custom obfuscation that prepends random characters to Base64 strings.
Supported commands include cmd, cmdno, dwn (exfiltrate files as attachments), and upl (upload files), with exfiltrated files staged in %TEMP%Temp before emailing and deletion.
The malicious DLL runs three Base64-encoded PowerShell commands, including copying the payload, performing nslookup to a webhook.site URL containing the victim username, and sending a curl request to a similar webhook.site URL to confirm execution.
NotDoor uses randomized variable/function names and custom encoding to hinder analysis and maintain a low detection profile.

MITRE Techniques

[T1036 ] Masquerading – Uses a legitimate signed Microsoft OneDrive.exe binary to load a malicious SSPICLI.dll via DLL side-loading (“the infection chain begins with Fancy Bear leveraging a legitimate, signed Microsoft OneDrive.exe binary, vulnerable to DLL side-loading”).
[T1213 ] Data from Information Repositories – Exfiltrates files via email attachments and stores them in %TEMP%Temp before sending (“Exfiltrated files are stored in %TEMP%Temp, named using predefined formats and extensions, and sent to an attacker-controlled email”).
[T1112 ] Modify Registry – Achieves persistence and disables macro prompts by modifying Outlook registry keys under SoftwareMicrosoftOffice16.0OutlookSecurity (“modifies the Windows registry, enabling automatic macro execution… further disables macro security protections by altering the `Level` subkey”).
[T1059.001 ] Command and Scripting Interpreter: PowerShell – Executes Base64-encoded PowerShell commands to copy payloads and perform network callbacks (“the malicious DLL executes three Base64-encoded PowerShell commands… one copies the malicious file… another performs an nslookup… the third sends a curl request”).
[T1064 ] Scripting – Uses VBA macros within Outlook to implement backdoor functionality and trigger on Outlook events (“a VBA macro-based malware… Outlook executes the embedded macros” and “utilizing events to trigger code execution when Outlook starts or a new email arrives”).
[T1566.001 ] Phishing: Spearphishing Attachment – Initial delivery and activation rely on malicious attachments/macros in Outlook-triggering emails and specific trigger strings (“The backdoor monitors incoming emails for specific trigger strings, such as ‘Daily Report,’ which activate its malicious capabilities”).
[T1033 ] System Owner/User Discovery – Uses victim username in DNS/webhook checks to confirm deployment (“performs an nslookup to a webhook.site domain incorporating the victim’s username”).

Indicators of Compromise

[File Hashes ] NotDoor sample hashes – fcb6dc17f96af2568d7fa97a6087e4539285141206185aec5c85fa9cf73c9193, 5a88a15a1d764e635462f78a0cd958b17e6d22c716740febc114a408eef66705 (and 1 more hash).
[File Path ] Outlook VBA payload location – %APPDATA%MicrosoftOutlookVbaProject.OTM (malicious file copied from c:programdatatesttemp.ini).
[Registry Key ] Persistence and security modifications – SoftwareMicrosoftOffice16.0OutlookSecurityLevel (registry changes to enable macros and suppress alerts).
[Domain/Hostname ] Network verification callbacks – webhook.site URLs used in nslookup and curl requests (webhook.site domain with victim username embedded).