Macro Exploits–Trusted Locations what you need to know

Malicious macro exploits have been a security issue for Office since the day macros were introduced. There are lots of legitimate work flow macros, so you cannot by default disable all macros in all Office programs. In the past you could create trusted macro locations within your network or system to add a layer of protection and prevention from malicious macros running.

GPO- Configuration/Administrative Templates/Microsoft Office XXX 20XX/Application Settings/Security/Trust Center/Trusted Locations

The latest threat though, with the added use of cloud locations, makes that harder to control and disable external document macros. While there is now an option to “Block macros from running in Office files from the Internet” unless users save the “trusted” cloud documents to a local path, designated as trusted in the GPO or system, then it may block legitimate work macros as well. So you will need to plan accordingly and remind the users “what to” and “what not to” open and where.

Knowing the average user is likely to click first on an attachment and ask long after the damage is done. The latest and worst macro exploit now triggers the newest malware craze “ransomware” such as Cerber. These two have been recently combined into yet another form of malware to thrash your data and systems.

The latest spam and phishing emails with those malicious attachments are currently concentrating on Office 365 users due to the fact that they know they have the Office suite to open the attachment macros and trigger the malware. The ransomware depends on the user to open the exploiting Macros by having end users “Enable Editing” and “Enabling Content” in the attachment. Here is an example of what one looks like:

The Cerber ransomware has been around since around March, but the Office 365 and cloud based targeting only just begun recently. Victims once they trigger the macro and are infected will see a ransomware note and the malware will also read aloud a note stating that their files have been encrypted.

Cerber uses AES-256 encryption and the victims are asked to pay about $800 U.S. dollars' worth in Bitcoin. If you don’t have a recent backup your only recovery option may be to pay the ransom if critical data is encrypted. Of course there is no guarantee they will honor the payment agreement.

If you are not using additional safeguards outside of what is provided by Microsoft, you could be at risk. I recommend you implement the following to help prevent ransomware from infecting your system:

• Spam filtering
• Firewalls
• DNS filtering (such as OpenDNS)
• Content filtering
• Antivirus/antimalware
• Group Policies to manage trusted locations
• Employee Policies that outline how to open external documents
• Backups (potentially ones that are not constantly connected to the network)