Cisco security team: hackers are attacking Excel users by injecting malicious code into XLL files

CTOnews.com, December 23 (Xinhua)-- Microsoft began blocking Word, Excel and PowerPoint from using certain macros (Macro) in July to prevent cyber attacks against Microsoft 365. After Microsoft closed these security vulnerabilities, hackers did not give up the pace of attack, and security companies recently discovered a vulnerability similar to a macro attack on Excel.

In the documents disclosed recently, the Cisco Cisco Talos Threat Source security team found that malicious actors were trying to use XLL files to attack Excel users.

CTOnews.com learned that XLL files are dynamic link library files that can only be opened by Excel to add additional functionality to spreadsheets. In the past few years, hackers have been using XLL files to launch attacks, with the highest density at the end of 2021.

"for a long time in the past, there have been only sporadic attacks using XLL files," said Vanja Svajcer, an outreach researcher at Cisco Talos. "but the number of attacks increased significantly in 2021 when malware families such as Dridex and Formbook started using it."

Organizations such as APT10 (also known as Chessmaster, Potassium, and menuPass), TA410 (also known as Cicada or Stone Panda), DoNot, and Fin7XLLs have been using XLLs to inject malware such as Anel Backdoor to steal information through keyloggings, password theft, and screen screenshots.

To keep yourself as secure as possible, Microsoft recommends that you do not open XLL files from untrusted sources and that you use the Office Trust Center to manage the plug-in's security settings.