Hackers Use PowerPoint Files for ‘Mouseover’ Malware Delivery

Powerpoint Image

Researchers from Cluster25 believe APT28, a Russian state-sponsored threat group, is using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations (T1566.001, T1204.002), which in turn triggers a malicious PowerShell script (T1059.001). While most Microsoft Office-based attacks require malicious macros, this new technique does not, making it especially dangerous.

“The threat actor lures targets with a PowerPoint (.PPT) file allegedly linked to the Organization for Economic Co-operation and Development (OECD), an intergovernmental organization working towards stimulating economic progress and trade worldwide. Inside the PPT file, there are two slides, both featuring instructions in English and French for using the Interpretation option in Zoom video-conferencing app” (Bleeping Computer, 2022).

The PPT file contains a hyperlink (T1204.001) which acts as a trigger for launching PowerShell scripts using the SyncAppvPublishingServer utility (T1569). This technique has been around since June 2017, but this is the first time researchers have seen it used inside an Office document without malicious macros. The campaign appears to have taken place between January and February of this year and then again in August in September with new URLs.

According to Cluster 25, the activity they have attributed to APT28 is using the PowerPoint mouse-over technique to deliver the Graphite malware. The campaign has targeted entities in the defense and government sectors of the European Union and Eastern Europe.

Never let your guard down when it comes to your digital security. Have questions about securing your network and providing the latest in digital security awareness training? Contact Citynet or call us: 1.844.CITYNET.

Like This Post?

Facebook
X
LinkedIn
Email

More Posts

Ticket Scam QR Image
Cybersecurity

You’ve Been Served… a Scam!

Beware of Fake Toll Violation Text Messages Cybercriminals are constantly evolving their tactics to trick people into giving up sensitive information. One of the latest scams circulating involves fake toll violation notices sent by text message. At first glance, the message looks convincing. It claims you have an unpaid traffic toll that must be paid immediately. The text often includes

Blog Cybercrime Calling Image
Cybersecurity

Cybercriminals Are Now Calling Your Employees

Is Your Business Prepared? Cyber threats are evolving, and one of the fastest-growing tactics right now is social engineering through trusted communication platforms. Instead of trying to hack their way in, cybercriminals are increasingly talking their way in. Attackers are impersonating IT staff, executives, vendors, and even coworkers via phone calls and collaboration tools such as Microsoft Teams, Webex, and other messaging

Laptop Typing With Icons Image
Cybersecurity

Shadow IT: The Apps Your Employees Use That IT Doesn’t Know About

When most businesses think about cybersecurity risk, they picture hackers breaking in from the outside. But one of the fastest-growing risks isn’t external at all. It’s happening inside your organization…quietly, unintentionally, and often with good intentions. It’s called Shadow IT. And it’s growing faster than most businesses realize. What Is Shadow IT? Shadow IT refers to any software, app, cloud platform,

Teamwork People Tablet Image
Cybersecurity

The New Employee Is Your Biggest Security Risk

(And It’s Not Their Fault) When businesses think about cybersecurity risk, they often picture hackers, ransomware, or sophisticated phishing attacks. But one of the most common — and overlooked — security risks starts on day one: A new employee. Not because they’re careless.Not because they’re malicious.But because onboarding and offboarding processes often leave dangerous gaps. If those gaps aren’t managed

Umbrella Covering Laptop Cybersecurity Image
Cybersecurity

The New Reality of Cyber Insurance Requirements for Small Businesses

Cyber insurance used to feel like a safety net. Today, it’s starting to feel more like an application for a mortgage. Across the country, insurance providers are tightening requirements, raising premiums, and even denying claims when businesses don’t meet modern cybersecurity standards. Many small and mid-sized organizations are discovering this shift the hard way, during policy renewal or after filing

Citynet Red Siege Webinar Post Image
Cybersecurity

Citynet and Red Siege Webinar Inside the Attacker’s Playbook

Cybersecurity isn’t just about defense — it’s about understanding how real attackers think. Join Citynet’s Craig Behr and Red Siege’s Tim Medin for an upcoming webinar, Inside the Attacker’s Playbook, where we’ll break down how real-world offensive operations uncover gaps — and how organizations can use those insights to reduce cyber risk before it becomes a business problem. Play Video

SuperPod with WiFi 6E

Plume SuperPod WiFi 6E Specs

SuperPod with WiFi 6

Plume SuperPod WiFi 6 Specs

SuperPod

Plume SuperPod Secs