{"id":375247,"date":"2021-12-01T21:19:12","date_gmt":"2021-12-01T18:19:12","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/hackers-are-using-rtf-files-in-phishing-campaigns\/"},"modified":"2021-12-01T21:19:12","modified_gmt":"2021-12-01T18:19:12","slug":"hackers-are-using-rtf-files-in-phishing-campaigns","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/hackers-are-using-rtf-files-in-phishing-campaigns\/","title":{"rendered":"#Hackers Are Using RTF Files in Phishing Campaigns"},"content":{"rendered":"

“#Hackers Are Using RTF Files in Phishing Campaigns”<\/strong><\/p>\n

\n
\"Hacker
ViChizh\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n

Hackers are increasingly using an\u00a0RTF template injection technique to phish for information from victims. Three APT hacking groups from India, Russia, and China, used a novel RTF template injection technique in their recent phishing campaigns.<\/p>\n

Researchers at Proofpoint<\/a> first spotted\u00a0the malicious RTF template injections in March 2021, and the firm expects it to become more widely used as time goes on.<\/p>\n

Here\u2019s what\u2019s happ<\/a>ening, according to Proofpoint:<\/p>\n

This technique, referred to as RTF template injection, leverages the legitimate RTF template functionality. It subverts the plain text document formatting properties of an RTF file and allows the retrieval of a URL resource instead of a file resource via an RTF\u2019s template control word capability.\u00a0This enables a threat actor to replace a legitimate file destination with a URL from which a remote payload may be retrieved.<\/p>\n<\/blockquote>\n

To put it simply, threat actors are placing malicious URLs in the RTF file through the template function, which can then\u00a0load malicious payloads into an application or perform Windows New Technology<\/a> LAN Manager (NTLM) authentication against a remote URL to steal Windows credentials, which could be disastrous for the user who opens these files.<\/p>\n

Where things get really scary is that these have a lower detection rate by antivirus apps when compared to the well-known Office-based template injection technique. That means you might download the RTF file, run it through an antivirus app and think it\u2019s safe when it\u2019s hiding something sinister.<\/p>\n

So what can you do to avoid it? Simply don\u2019t download and open RTF files (or any other files, really) from people you don\u2019t know. If something seems suspicious, it probably is. Be careful what you download, and you can mitigate the risk of these RTF template injection attacks.<\/p>\n

RELATED:<\/strong> Want to Survive Ransomware? Here’s How to Protect Your PC<\/em><\/strong><\/p>\n<\/div>\n