Orphaned VBA Projects Inside DWG Files: New Phishing Vector Discovered

In a novel approach, attackers have leveraged Orphaned VBA Projects embedded within AutoCAD drawing files (.dwg) to deliver malicious payloads. This exploitation represents a significant deviation from traditional file format vectors, targeting industries reliant on CAD software. According to a recent analysis by the SANS Internet Storm Center, this methodology was observed in the wild, targeting engineering and architectural firms.

The essence of this attack lies in embedding VBA projects inside DWG files — a tactic not commonly associated with VBA exploits. This new vector exploits the trust and frequency with which these professionals handle DWG files, camouflaging its intent within a seemingly benign environment.

Campaign or TTP Overview

In late 2023, researchers identified a phishing campaign deploying AutoCAD’s DWG file format as a carrier for malicious VBA projects. The campaign primarily targeted the construction and engineering sectors, exploiting the reliance of these sectors on AutoCAD for daily operations. The orchestrators of this phishing scheme remain unattributed, but the sophistication suggests a group with significant capabilities in cyber intrusions.

Attackers created DWG files containing Orphaned VBA Projects, which upon opening, executed malicious macros. The payload inclusions suggested aims such as credential theft and unauthorized data exfiltration. With users conditioned to trust DWG files, this vector leveraged low suspicion rates to efficiently infiltrate target networks.

How It Was Built

The campaign’s technical framework involved embedding VBA Projects in DWG files using AutoCAD’s scripting capabilities. Attackers weaponized these files with a straightforward delivery mechanism: email phishing campaigns. Emails purportedly from known vendors or partners bore subject lines like “Updated Site Plans – Action Required” to compel user engagement.


Subject: Updated Site Plans - Action Required

From: projects@trusted-partner.com

Attachment: New_Site_Plan.dwg

Message: Dear [Recipient], Please find attached the updated site plans for your review. Contact us for further details.

The payload executed upon opening the DWG file, leveraging VBA to run a script for downloading secondary payloads or exfiltrating sensitive data. The infrastructure supporting this phish included compromised domains appearing legitimate and cleverly crafted email headers to bypass basic email gateway defenses.

Why It Worked

This campaign’s success hinged on several strategic choices. First, the use of DWG files leveraged industry-specific familiarity, reducing initial suspicion. Professionals within targeted sectors frequently exchange such files, ensuring immediate interaction without hesitation.

Secondly, the attackers mimicked legitimate partner identities, employing domain names equipped with valid SPF and DKIM records for enhanced deliverability. This strategic identity selection effectively reduced the likelihood of the emails being flagged as spam, greatly increasing the phishing campaign’s reach.

Finally, embedding VBA Project components within a non-standard file format like DWG, traditionally devoid of macro capabilities, blindsided conventional security mechanisms primed to detect macro exploits in expected formats such as Word or Excel.

Operator Takeaways

For red teamers, this campaign underscores the potential of exploiting unconventional file formats. By exploring industry-specific file types, operators can significantly enhance the realism and specificity of their engagements.

Additionally, integrating tactics like domain identity spoofing — complete with authentic SPF and DKIM records — increases the success rate of phishing emails reaching the target inbox. Red teamers should emulate intricate social engineering schemes to study how these practices affect engagement rates.

Good / Better / Best

Good: Attaching generic file formats like PDFs or DOCX with basic macro payloads. These have become easily detectable but might still engage untrained targets.

Better: Using file types specific to target industry (e.g., DWG in architecture) with obfuscated payloads, leveraging sector-specific lingo and identities.

Best: Deploying industry-specific file types with embedded Orphaned VBA Projects alongside flawless domain identity spoofing, supported by real-time C2 communication and payload updates, ensuring maximum engagement and minimal detection.