The attack starts off with a seemingly inconspicuous email regarding voting in the upcoming general election, as follows:

“What not to do on voting day? If you commit a crime, you will be fined $2 million and jailed for two years.”

The email goes on, listing some of the things that a voter should not be doing on the election day:

“Voting steps:

1. Bring your ID card, seal, and voting notice to the voting station.

2. Show your ID to the on-site staff for identity verification.

3. Sign or stamp the ballot to receive it.

4. Go to the ballot box to vote and use the Election Committee’s stamping tool to circle your ballot.

5. Insert the ballot into the corresponding slot.

6. Complete your vote.”

Interestingly, the email never explicitly entices the user to click on any attachments, but the document attached is called the following:

Voting Instructions.docx

Our investigations have revealed that multiple versions of the same document (hashes listed below) have been sent to prominent business leaders. It is currently not clear what the attackers are looking to gain, but it could be to monitor the sentiments of voters.

So, next up is the Word document itself. It is a completely blank and empty word document, but investigating the document.xml properties, it shows a link to an OleObject:

Fig. 1 - document.xml

This is similar to the Follina exploits of 2023 but with one key difference, the link type is now represented as a picture and UpdateMode is set to Always rather than “OnCall.” This means that the script auto executes on document open. We believe that there is a second stage dropper, exploiting a new vulnerability in Windows, similar to the Microsoft diagnostic tool exploit seen within the Follina attack chain.

Fig. 2 - document.xml.rels

Within document.xml.rels, there is a reference to an external OleObject which has a target of the stage 2 dropper. This URL has been redacted due to the link still being active and working. Forcepoint is working with the relevant authorities to ensure the link is shut down and made inactive.

We have been unable to execute the second stage of the attack, due to the extremely targeted nature of the attack. It is likely that the web server hosting the second stage is configured to deploy the second stage to specific IP addresses.

In lieu of this, we deployed the second stage of the Follina attack to demonstrate that the embedded OleObject is a new, novel way of being able to launch an MSHTML file to deploy the malware payload itself.

At this moment in time, it is not clear that there is any ability to change the configuration of Microsoft Office to prevent this exploit.

Zero Trust CDR Protects Against This Attack

Anti-malware detection is not working – the example document is not currently being reported as malicious by any of the prominent vendors on VirusTotal – probably because targeted attacks like this don’t have the consistency of patterns to form accurate signatures.

What’s needed is a way of stopping the initial malware reaching its target, and that’s what Forcepoint’s Zero Trust CDR achieves. It doesn’t deliver the original file. It builds a new file that looks and feels the same, but without the malicious content. In this case, the OleObject reference is external, so we simply do not build the new file with reference.

Forcepoint’s Zero Trust CDR is the only solution that can viably remove zero day and advanced undetectable threats without ever needing to rely on detection.

Forcepoint Data Security Cloud

Forcepoint DSPM + DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint Email Security

Data Classification

الرعاية الصحية

الخدمات المالية

القطاع العام

DLP for Healthcare

حماية استخدام الذكاء الاصطناعي من الجيل

حماية البيانات في ChatGPT

How to Protect Your Data Everywhere

شاهد برنامج Data Detection & Response (DDR) قيد التنفيذ

المدونات

البث عبر الويب

البودكاست

تقارير Analyst

قصص العملاء

مكتبة الموارد

التدريب والشهادات

Cyber EDU

الدليل

الدليل التنفيذي العملي لمنع فقدان البيانات

الدليل

Forcepoint AI Mesh

تقرير المحللين

Gartner: 2025 Market Guide for Data Loss Prevention

بودكاست

سلسلة بودكاست To The Point

نهجنا

عملاؤنا

Forcepoint مقابل Netskope

Forcepoint مقابل Palo Alto Networks

Forcepoint مقابل Zscaler

من نحن

غرفة الأخبار

انضم إلينا

تواصل معنا

Forcepoint Trust Hub

VAKIFBANK يعزز الوضع الأمني وتقارير الامتثال

Eczacíbaashí Holding توسع الأمان ليشمل السحابة لحماية الموظفين العالمين عن بُعد

Communisis تقوم بتحديث Forcepoint DLP من خلال Risk-Adaptive Protection

X-Labs Researcher