NVISO Labs Researchers noticedthat the Epic Manchego group is using unusual Excel files designed specifically to bypass defense mechanisms for attacks. The fact is that these files are not created through Microsoft Office, but using the .NET library. EPPlus…
Typically, this library is used by application developers, for example, to add features such as "Export to Excel" or "Save as Spreadsheet". The library can be used to create files in a wide variety of formats and supports Excel 2019.
Experts write that hackers seem to be using EPPlus to create spreadsheets in Office Open XML (OOXML) format. The files produced by Epic Manchego are missing some of the VBA code typical of Excel documents compiled in proprietary Microsoft Office.
It turned out that some antivirus products and email scanners consider this part of the VBA code as one of the possible signs of a suspicious Excel file, because, as a rule, this is where the malicious code is stored. Therefore, Epic Manchego special files are much less likely to be detected by security solutions (compared to other malicious Excel files).
Of course, this does not mean that Epic Manchego files are completely harmless. Although the files worked correctly, like any other Excel document, experts explain that cybercriminals store malware in them using a custom VBA code format, which is also password protected so that security systems and information security specialists cannot analyze the content.
Analysts point out that using EPPlus not only helped, but also hurt Epic Manchego. The point is that experts were able to discover numerous past grouping operations by simply looking for unusual Excel files. As a result, more than 200 files related to Epic Manchego were discovered, the first of which dates back to June 22 of this year.
As you might guess, such malicious documents contain a malicious macro script. For example, if the victim opens the Excel file and allows the script to execute, the macros will download and install malware on their machine. Payloads in this case are classic infostealer Trojans such as Azorult, AgentTesla, Formbook, Matiex and njRat, which steal passwords from browsers, mail and FTP clients and send them to Epic Machengo servers.
It is worth noting that, in general, NVISO Labs experts were not surprised that the hack group was using EPPlus for attacks. They write:
"We have been familiar with this .NET library for a long time, as we have been using it for several years to create malicious documents for our red team and pentesters."