Microsoft to block Excel XLL files from the internet • The Register

Microsoft in March will begin blocking Excel XLL add-ins from the web to close down an more and more in style assault vector for miscreants.

In a one-sentence note on its Microsoft 365 roadmap, the seller mentioned the transfer was in response to “the growing variety of malware assaults in current months.”

Safety researchers have mentioned that after Microsoft started blocking Visible Fundamental for Utility (VBA) macros by default in Phrase, Excel, and PowerPoint in July 2022 to chop off a well-liked assault avenue, menace teams started utilizing different choices, resembling LNK files and ISO and RAR attachments.

In December, Cisco’s Talos menace intelligence group detailed one other software that cybercriminals have been focusing on: Excel XLL recordsdata. The Talos researchers not solely broke down how the crooks use the XLL recordsdata however detailed a pointy enhance of their use since Microsoft shut the VBA macros door, noting that the primary malicious samples have been submitted to VirusTotal in 2017.

“For fairly a while after that, the utilization of XLL recordsdata is just sporadic and it doesn’t enhance considerably till the top of 2021, when commodity malware households resembling Dridex and Formbook began utilizing it,” Vanja Svajcer, outreach researcher for Talos, wrote within the report.

That should not come as a shock, Dave Storie, adversarial collaboration engineer at LARES Consulting, advised The Register.

“When organizations like Microsoft scale back the assault floor or in any other case enhance the trouble required to execute an assault on their product choices, it forces menace actors to discover alternate avenues,” Storie mentioned. “This usually results in exploring beforehand recognized, maybe much less excellent, choices for menace actors to attain their aims.”

Even earlier than this yr, some researchers have been seeing miscreants make their technique to XLL recordsdata. Researchers with HP’s Wolf Safety said that in This autumn 2021, there was a 588 % year-over-year bounce in attackers utilizing the recordsdata to compromise programs, including that they anticipated the pattern to proceed in 2022, although it was unclear on the time if Excel add-ins would exchange Workplace macros because the cyber-weapon of selection.

XLL recordsdata are a kind of DLL file which are solely opened in Excel and allow third-party purposes so as to add extra performance to spreadsheets. In Excel, if a person needs to open a file with a .XLL extension in Home windows Explorer, the system will mechanically attempt to launch Excel and open the file, triggering Excel to show a warning about doable harmful code, much like that proven when an Workplace doc containing VBA macro code is opened.

And as with VBA macros, customers usually will disregard the warning.

“XLL recordsdata might be despatched by electronic mail, and even with the standard anti-malware scanning measures, customers might be able to open them not figuring out that they might comprise malicious code,” Svajcer wrote.

Andrew Barratt, vice chairman at Coalfire, advised The Register that lowering the variety of dialog bins which customers should take care of – and that cybercriminals know shall be ignored by many – is a win for safety groups.

“To steal a typical infosec buzzword, one of the best ways to consider these are like ‘next-gen’ macro assaults,” Barratt mentioned. “As with a lot of all these assaults, the perfect place for the software program to take is to disable the aptitude and have a prompt-and-alert course of. The problem is that over time we see the ‘are you certain, you are certain’ fatigue set in.” ®