Description

The Outlook NotDoor backdoor malware, first identified by Lab52 of S2 Grupo and linked to the APT28/Fancy Bear cyber-espionage group, represents a highly sophisticated threat that abuses trusted Microsoft Outlook components to maintain persistence and steal sensitive data. NotDoor embeds malicious macros inside Outlook data files, enabling the malware to silently monitor email activity and execute hidden commands. This technique allows attackers to quietly exfiltrate data, gain long-term access, and hijack email workflows without alerting victims. The backdoor’s stealthy behavior is strengthened by its ability to manipulate Outlook’s VBA macro environment, obfuscate its code, and automatically trigger execution when specific emails arrive. The infection chain often begins with DLL sideloading, a technique in which attackers plant a malicious SSPICLI.dll next to the legitimate OneDrive.exe to exploit Windows’ default DLL loading order. Once loaded, the fake DLL executes hidden payloads, launches encoded PowerShell commands, and establishes directories under the TEMP folder to store multiple malware artifacts such as tmp7E9C.dll and testtemp.ini. This file contains the macro code eventually copied into Outlook’s VBAProject.OTM directory. Splunk researchers provided one of the most detailed technical analyses, highlighting the malware’s behavior, including suspicious process spawning (especially PowerShell), network communications, and Registry tampering that lowers macro security settings and forces automatic macro loading all essential indicators for defenders. A crucial part of NotDoor’s persistence involves modifying Windows Registry keys that force Outlook to load malicious macros at startup while disabling security prompts. These macros establish command-and-control communication through email-based triggers, allowing attackers to execute instructions and quietly exfiltrate files. Obfuscation, random variable naming, and encoded scripts help the malware evade simple detection. Combined with its abuse of email workflows and DLL sideloading, NotDoor poses a significant risk to organizations that rely heavily on Outlook for communications. Splunk’s research offers defenders practical detection methods by correlating anomalous registry writes, unauthorized modification of Outlook macro files, rogue PowerShell invocations from OneDrive.exe, and abnormal Outlook behavior indicative of this espionage-focused backdoor.