# MA-711.012019: MyCERT Alert - New Threadkit Office Builder

**Date:** 24 Jan 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-711.012019  
**Advisory ID:** MA-711.012019

---

**1.0    Introduction**
Recently, trusted third parties has identified a new version of Threadkit. The common Tactic, Technic and Procedure (TTPs) used was by delivering the malware via phishing email. The phishing email contained RFT Microsoft Office attachment with an evolved version of the exploit builder kit first uncovered in October 2017. The new version of ThreadKit utilizes a macro delivery framework sold and used by numerous actors and groups.
This new version is designed to evade detection by adding obfuscation techniques that include “placing the ‘M’ from the ‘MZ’ of an executable file into its own object and renaming a number of the objects inside. Threat actor also includes new download URL where the malware code “objects” are downloaded from and later combined to create the executable.
**2.0    Impact**
ThreadKit can be used to create documents that are using CVE 2017-8759 and CVE 2017-11882 as well, and in its newest update the kit was embedded with new exploits, which are targeting vulnerabilities such as an Adobe Flash zero-day (CVE-2018-4878) and several new Microsoft Office vulnerabilities, including CVE-2018-0802 and CVE-2017-8570.
**3.0    Recommendation**
MyCERT advises all users to be alert and do the necessary to secure their machines. Attached below are some recommendations for users as preventive measures and mitigation steps against this attack.
•    Keep your operating system and application software up-to-date - Install software patches so that attackers cannot take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it.
•    Use anti-malware tools - Using a legitimate program that identifies and removes malware can help eliminate an infection.
•    Use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date.
•    Filter email with specific attachment - Organizations should pay attention to email messages with suspicious Word or Excel attachments, especially those that ask permission to 'Enable Content' for running macros
For incident reporting and other enquiries, please contact MyCERT through the following channels:
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#adced4cfc8df949494edced4cfc8dfdec8ced8dfc4d9d483c0d4) or [[email protected]](/cdn-cgi/l/email-protection#f895819b9d8a8cb895819b9d8a8cd6978a9fd69581)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**4.0    References**
•    <https://malwaretips.com/threads/new-threadkit-office-exploit-builder-emerges.81266/>
•    <https://threatpost.com/cobalt-threadkit-malware/139800/>
•    <https://blog.cyberbyte.org/blog/a-new-version-of-threadkit-office-exploit-builder-is-available-on-the-cyber-web/>
•    <https://nvd.nist.gov/vuln/detail/CVE-2017-8759>
•    <https://nvd.nist.gov/vuln/detail/CVE-2017-8570>
•    <https://nvd.nist.gov/vuln/detail/CVE-2017-11882>
•    <https://nvd.nist.gov/vuln/detail/CVE-2018-4878>
•    <https://nvd.nist.gov/vuln/detail/CVE-2018-0802>