The attack starts off with a seemingly inconspicuous email regarding voting in the upcoming general election, as follows:

“What not to do on voting day? If you commit a crime, you will be fined $2 million and jailed for two years.”

The email goes on, listing some of the things that a voter should not be doing on the election day:

“Voting steps:

1. Bring your ID card, seal, and voting notice to the voting station.

2. Show your ID to the on-site staff for identity verification.

3. Sign or stamp the ballot to receive it.

4. Go to the ballot box to vote and use the Election Committee’s stamping tool to circle your ballot.

5. Insert the ballot into the corresponding slot.

6. Complete your vote.”

Interestingly, the email never explicitly entices the user to click on any attachments, but the document attached is called the following:

Voting Instructions.docx

Our investigations have revealed that multiple versions of the same document (hashes listed below) have been sent to prominent business leaders. It is currently not clear what the attackers are looking to gain, but it could be to monitor the sentiments of voters.

So, next up is the Word document itself. It is a completely blank and empty word document, but investigating the document.xml properties, it shows a link to an OleObject:

Fig. 1 - document.xml

This is similar to the Follina exploits of 2023 but with one key difference, the link type is now represented as a picture and UpdateMode is set to Always rather than “OnCall.” This means that the script auto executes on document open. We believe that there is a second stage dropper, exploiting a new vulnerability in Windows, similar to the Microsoft diagnostic tool exploit seen within the Follina attack chain.

Fig. 2 - document.xml.rels

Within document.xml.rels, there is a reference to an external OleObject which has a target of the stage 2 dropper. This URL has been redacted due to the link still being active and working. Forcepoint is working with the relevant authorities to ensure the link is shut down and made inactive.

We have been unable to execute the second stage of the attack, due to the extremely targeted nature of the attack. It is likely that the web server hosting the second stage is configured to deploy the second stage to specific IP addresses.

In lieu of this, we deployed the second stage of the Follina attack to demonstrate that the embedded OleObject is a new, novel way of being able to launch an MSHTML file to deploy the malware payload itself.

At this moment in time, it is not clear that there is any ability to change the configuration of Microsoft Office to prevent this exploit.

Zero Trust CDR Protects Against This Attack

Anti-malware detection is not working – the example document is not currently being reported as malicious by any of the prominent vendors on VirusTotal – probably because targeted attacks like this don’t have the consistency of patterns to form accurate signatures.

What’s needed is a way of stopping the initial malware reaching its target, and that’s what Forcepoint’s Zero Trust CDR achieves. It doesn’t deliver the original file. It builds a new file that looks and feels the same, but without the malicious content. In this case, the OleObject reference is external, so we simply do not build the new file with reference.

Forcepoint’s Zero Trust CDR is the only solution that can viably remove zero day and advanced undetectable threats without ever needing to rely on detection.

Forcepoint Data Security Cloud

Forcepoint DSPM + DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint Email Security

Data Classification

Santé

Services financiers

Secteur public

Sécuriser l’utilisation de l’IA générative

Protéger les données dans ChatGPT

How to Protect Your Data Everywhere

Découvrez notre logiciel Data Detection & Response (DDR) en action

Blogs

Webémissions

Podcasts

Rapports d'analyses

Témoignages de clients

Ressources

Formation et certifications

Cyber EDU

GUIDE

Prévenir la perte des données : le guide du dirigeant

GUIDE

AI Mesh de Forcepoint

RAPPORT D’ANALYSE

Gartner: 2025 Market Guide for Data Loss Prevention

BALADO

Série de podcasts To The Point

Notre approche

Nos clients

Forcepoint vs. Netskope

Forcepoint vs. Palo Alto Networks

Forcepoint vs. Zscaler

À propos de Forcepoint

Salle de presse

Travailler avec nous

Nous contacter

Forcepoint Trust Hub

VAKIFBANK renforce sa posture de sécurité et ses rapports de conformité

Eczacıbaşı Holding étend la sécurité au cloud pour protéger le personnel travaillant à distance

Communisis modernise son Forcepoint DLP avec Risk-Adaptive Protection

X-Labs Researcher