APT28 Exploits Microsoft Outlook: Inside the 2024 NotDoor Backdoor Attack
Executive Summary
In 2024, the Russian state-sponsored group APT28 (also known as Fancy Bear) leveraged a new backdoor called "NotDoor" to infiltrate targeted organizations via Microsoft Outlook. Researchers from Lab52 revealed that attackers delivered NotDoor using DLL sideloading through OneDrive.exe, enabling them to bypass Outlook's macro security and gain persistent access. Once deployed, NotDoor monitored incoming Outlook emails for specific trigger words, allowing APT28 to exfiltrate sensitive data, upload malicious files, and execute remote commands without detection. Outlook's native functions were abused to provide covert communications and stealthy data transfers, making detection difficult.
This incident illustrates the continued evolution of state-sponsored attack methods, especially the abuse of ubiquitous business software like Microsoft Outlook for stealthy, command-and-control operations. Organizations face mounting pressure to address advanced persistent threats exploiting native application behaviors and to enhance email and endpoint security in response to these sophisticated tactics.
Why This Matters Now
APT28's exploitation of Outlook for covert operations demonstrates adversaries' ability to weaponize everyday business tools for stealthy intrusions. The rapid adaptation of techniques like DLL sideloading and macro abuse underscores the urgent need for organizations to harden security controls around common communication platforms, as threat actors increasingly target these to bypass traditional defenses.
Attack Path Analysis
APT28 achieved initial compromise by delivering a malicious DLL via DLL sideloading with a signed OneDrive.exe binary, enabling macro execution in Microsoft Outlook. The adversary escalated privileges by disabling macro security defenses and automating macro execution. Lateral movement potentially occurred via internal network or Outlook-based lateral delivery, with the backdoor enabling movement across workloads. For command and control, the NotDoor VBA macro established covert communication through email triggers and DNS tunneling via DNSHook. Exfiltration transpired through Outlook email channels, with data sent as email attachments or via DNS exfiltration. The impact included persistent remote access, ability to execute arbitrary commands, and covert data theft without detection.
Kill Chain Progression
Initial Compromise
Description
Attackers abused DLL sideloading on a trusted OneDrive.exe binary to load a malicious SSPICLI.dll, disabling macro defenses and delivering the Outlook VBA macro backdoor.
Related CVEs
CVE-2017-6742
CVSS 8.8A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software could allow an authenticated, remote attacker to execute code remotely on an affected system or cause an affected system to reload.
Affected Products:
Cisco IOS and IOS XE – various versions prior to the fix
Exploit Status:
exploited in the wildCVE-2023-23397
CVSS 9.8A critical elevation of privilege vulnerability in Microsoft Outlook on Windows, exploited when a specially crafted message triggers a Net-NTLMv2 hash leak to a threat actor-controlled server.
Affected Products:
Microsoft Outlook – all versions prior to the fix
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Modify Authentication Process: Dynamic Link Library Injection
Phishing: Spearphishing Attachment
Office Application Startup: Outlook VBA
Command and Scripting Interpreter: PowerShell
Subvert Trust Controls: Code Signing
Data from Local System
Exfiltration Over Alternative Protocol: Exfiltration Over Uncommonly Used Protocol
Application Layer Protocol: Email Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Audit Log Review
Control ID: 10.2.5
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Art. 6
CISA ZTMM 2.0 – Manage Identities and Authentication
Control ID: PR.AC-1
NIS2 Directive – Policies and Procedures to Assess Effectiveness of Cybersecurity Risk Management Measures
Control ID: Art. 21(2)(e)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
APT28's NotDoor malware targeting Microsoft Outlook poses critical threats to government communications, enabling covert data exfiltration and command execution within sensitive administrative systems.
Financial Services
Outlook-based backdoor threatens financial institutions' email communications, compromising confidential client data and transaction information through sophisticated macro-based persistence mechanisms and lateral movement capabilities.
Defense/Space
Russian state-sponsored NotDoor malware specifically targets defense sector communications via Microsoft Outlook, enabling persistent access and classified information exfiltration through encrypted traffic channels.
Law Practice/Law Firms
Legal sector faces heightened risks from APT28's email-based backdoor, threatening privileged attorney-client communications and sensitive case information through DLL sideloading and macro exploitation.
Sources
- Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malwarehttps://www.darkreading.com/endpoint-security/apt28-outlook-notdoor-backdoorVerified
- APT28 Exploits Known Vulnerability To Carry Out Reconnaissance and Deploy Malware on Cisco Routershttps://www.cisa.gov/news-events/alerts/2023/04/18/apt28-exploits-known-vulnerability-carry-out-reconnaissance-and-deploy-malware-cisco-routersVerified
- Guidance for investigating attacks using CVE-2023-23397https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west visibility, egress controls, and inline threat detection would have significantly disrupted each phase, limiting macro delivery, lateral pivoting, C2, and exfiltration through enforcement and real-time detection. The deployment of cloud-native segmentation and anomaly monitoring can drastically decrease attacker dwell time and access scope.
Control: Inline IPS (Suricata)
Mitigation: Malicious binary and exploit signatures detected and blocked at first contact.
Control: Threat Detection & Anomaly Response
Mitigation: Alert generated for behavioral deviation and unauthorised macro activity.
Control: Zero Trust Segmentation
Mitigation: Movement between workloads and network segments is restricted by least privilege policy.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound C2 channels are detected, blocked, or quarantined.
Control: Multicloud Visibility & Control
Mitigation: Anomalous outbound data transfer and suspicious DNS activity is swiftly alerted and contained.
Autonomous controls contain compromise and limit attacker persistence.
Impact at a Glance
Affected Business Functions
- Email Communications
- Data Security
- Network Operations
Estimated downtime: 5 days
Estimated loss: $500,000
Potential exposure of sensitive corporate communications and confidential data due to unauthorized access facilitated by the NotDoor malware.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust segmentation to restrict movement from compromised endpoints and isolate risky applications.
- • Deploy inline IPS and outbound egress controls to block or detect DLL sideloading and covert C2/exfiltration paths.
- • Leverage network-wide anomaly detection and behavioral baselining for rapid identification of macro and email-based abuse.
- • Centralize policy control and visibility to rapidly identify anomalous east-west and outbound behaviors across multi-cloud environments.
- • Regularly review and harden macro, scripting, and application policies to close initial compromise entry points exploited by APT actors.
