- Products
- Learn
- Local User Groups
- Partners
-
More
Celebrate the New Year
With CheckMates!
Value of Security
Vendor Self-Awareness
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
Mobile Security
Buyer's Guide Out Now
Important! R80 and R80.10
End Of Support around the corner (May 2021)
We are witnessing a surge in weaponized Microsoft documents containing a macro.
This campaign has very low detection by signature based solutions. It uses advanced social engineering techniques designed to make the user open the document and enable the macro. As you can see in the screen shots these are similar but more graphically adapt to the notorious locky campaign of 2016.
Screen shot of documents cleaned by Threat Extraction.
The last couple of days show a ten fold increase in the malicious files.
The surge as seen in numbers in the last week.
SandBlast Threat Extraction cleans the macro from the document at zero time.
SandBlast prevents the download of the original file by three zero day engines: Macro Analyzer, CPU level detection on crash and the emulator by its malicious process activity.
I'll update when there is more data.
Thanks,
Gadi
Gad,
Can you tell if the TX is necessary for this protection to work or if TE will be able to catch it?
Hi Vladimir,
Yes, TE is able to catch it and prevent it.
I'll upload a report
Sample this morning came with two word documents. AV Blade caught the emails. Does Emotet usually send two attachments?
Not that I am aware of, please do share
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY