Initial Access Brokers Target Brazil Execs via NF
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) |
Full article607 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 09, 2025Malware / Email Security
Cybersecurity researchers are warning of a new campaign that's targeting Portuguese-speaking users in Brazil with trial versions of commercial remote monitoring and management (RMM) software since January 2025.
"The spam message uses the Brazilian electronic invoice system, NF-e, as a lure to entice users into clicking hyperlinks and accessing malicious content hosted in Dropbox," Cisco Talos researcher Guilherme Venere said in a Thursday report.
The attack chains begin with specially crafted spam emails that claim to originate from financial institutions or cell phone carriers, warning of overdue bills or outstanding payments in order to trick users into clicking on bogus Dropbox links that point to a binary installer for the RMM tool.
Two notable RMM tools observed are N-able RMM Remote Access and PDQ Connect, granting attackers the ability to read and write files to the remote file system.
In some cases, the threat actors then use the remote capabilities of these agents to download and install an additional RMM software such as ScreenConnect after the initial compromise.
Based on the common recipients observed, the campaign has been found to mainly target C-level executives and financial and human resources account across several industries, including some educational and government institutions.
It has also been assessed with high confidence that the activity is the work of an initial access broker (IAB) that's abusing the free trial periods associated with various RMM programs to gain unauthorized access. N-able has since taken steps to disable the affected trial accounts.
"Adversaries' abuse of commercial RMM tools has steadily increased in recent years," Venere said. "These tools are of interest to threat actors because they are usually digitally signed by recognized entities and are a fully featured backdoor."
"They also have little to no cost in software or infrastructure, as all of this is generally provided by the trial version application."
The development comes amid the emergence of various phishing campaigns that are engineered to sidestep modern defenses and propagate a wide range of malware families, or collect victims' credentials -
- A campaign conducted by a South American cybercrime group called Hive0148 to distribute the Grandoreiro banking trojan to users in users in Mexico and Costa Rica.
- A campaign that employs a legitimate file-sharing service named GetShared to bypass security protections and direct users to links hosting malware
- A campaign that uses sales order-themed lures to deliver the Formbook malware by means of a Microsoft Word document that's susceptible to a years-old flaw in Equation Editor (CVE-2017-11882)
- A campaign that has targeted organizations in Spain, Italy, and Portugal using invoice-related themes to deploy a Java-based remote access trojan named Ratty RAT that can execute remote commands, log keystrokes, capture screenshots, and steal sensitive data
- A campaign that uses a legitimate note-taking application known as Milanote and an adversary-in-the-middle (AitM) phishing kit dubbed Tycoon 2FA to capture users' credentials under the guise of viewing a "new agreement"
- Campaigns that utilize encoded JavaScript within SVG files, booby-trapped links in PDF attachments, dynamic phishing URLs that are rendered at runtime inside OneDrive-hosted files, and archived MHT payloads within OpenXML structures to direct users to credential harvesting or phishing pages
- Campaigns that abuse Cloudflare's TryCloudflare tunneling feature to deploy malware like AsyncRAT
"Attackers continuously evolve tactics to bypass modern email and endpoint security solutions, making detecting and mitigating phishing attempts increasingly difficult," Intezer researcher Yuval Guri noted last month. "And despite advancements in cybersecurity tools, many phishing campaigns still successfully reach users' inboxes."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/initial-access-brokers-target-brazil.html