The attack starts off with a seemingly inconspicuous email regarding voting in the upcoming general election, as follows:

“What not to do on voting day? If you commit a crime, you will be fined $2 million and jailed for two years.”

The email goes on, listing some of the things that a voter should not be doing on the election day:

“Voting steps:

1. Bring your ID card, seal, and voting notice to the voting station.

2. Show your ID to the on-site staff for identity verification.

3. Sign or stamp the ballot to receive it.

4. Go to the ballot box to vote and use the Election Committee’s stamping tool to circle your ballot.

5. Insert the ballot into the corresponding slot.

6. Complete your vote.”

Interestingly, the email never explicitly entices the user to click on any attachments, but the document attached is called the following:

Voting Instructions.docx

Our investigations have revealed that multiple versions of the same document (hashes listed below) have been sent to prominent business leaders. It is currently not clear what the attackers are looking to gain, but it could be to monitor the sentiments of voters.

So, next up is the Word document itself. It is a completely blank and empty word document, but investigating the document.xml properties, it shows a link to an OleObject:

Fig. 1 - document.xml

This is similar to the Follina exploits of 2023 but with one key difference, the link type is now represented as a picture and UpdateMode is set to Always rather than “OnCall.” This means that the script auto executes on document open. We believe that there is a second stage dropper, exploiting a new vulnerability in Windows, similar to the Microsoft diagnostic tool exploit seen within the Follina attack chain.

Fig. 2 - document.xml.rels

Within document.xml.rels, there is a reference to an external OleObject which has a target of the stage 2 dropper. This URL has been redacted due to the link still being active and working. Forcepoint is working with the relevant authorities to ensure the link is shut down and made inactive.

We have been unable to execute the second stage of the attack, due to the extremely targeted nature of the attack. It is likely that the web server hosting the second stage is configured to deploy the second stage to specific IP addresses.

In lieu of this, we deployed the second stage of the Follina attack to demonstrate that the embedded OleObject is a new, novel way of being able to launch an MSHTML file to deploy the malware payload itself.

At this moment in time, it is not clear that there is any ability to change the configuration of Microsoft Office to prevent this exploit.

Zero Trust CDR Protects Against This Attack

Anti-malware detection is not working – the example document is not currently being reported as malicious by any of the prominent vendors on VirusTotal – probably because targeted attacks like this don’t have the consistency of patterns to form accurate signatures.

What’s needed is a way of stopping the initial malware reaching its target, and that’s what Forcepoint’s Zero Trust CDR achieves. It doesn’t deliver the original file. It builds a new file that looks and feels the same, but without the malicious content. In this case, the OleObject reference is external, so we simply do not build the new file with reference.

Forcepoint’s Zero Trust CDR is the only solution that can viably remove zero day and advanced undetectable threats without ever needing to rely on detection.

Forcepoint Data Security Cloud

Forcepoint DSPM + DDR

Forcepoint DLP

Forcepoint Web Security

Forcepoint Cloud App Security

Risk-Adaptive Protection

Forcepoint Email Security

Data Classification

보건 의료

금융 서비스

공공부문

Gen AI 사용 보호

ChatGPT에서 데이터 보호

How to Protect Your Data Everywhere

당사의 데이터 탐지 및 대응(DDR) 소프트웨어의 작동 현황을 확인해 보세요

블로그

웹캐스트

팟캐스트

분석가 보고서

고객 사례

자료실

교육 및 인증

Cyber EDU

가이드

데이터 손실 예방을 위한 실무 책임자 가이드

가이드

Forcepoint AI Mesh

분석 보고서

Gartner: 2025 Market Guide for Data Loss Prevention

팟캐스트

The Point 팟캐스트 시리즈

당사의 접근 방식

당사 고객

Forcepoint 대 Netskope

Forcepoint 대 Palo Alto Networks

Forcepoint 대 Zscaler

회사 소개

뉴스룸

채용 정보

문의하기

Forcepoint Trust Hub

VAKIFBANK는 보안 상태 및 규정 준수 보고를 강화합니다

Eczacıbaşı Holding은 보안을 클라우드로 확장하여 원격 직원을 보호합니다

Communisis는 Risk-Adaptive Protection을 통해 Forcepoint DLP를 현대화합니다

X-Labs Researcher