Log in Request a demo

Security News

A New Malware Campaign Detected through Microsoft OneNote Files

OneNote malware campaigns hide malicious files under fake buttons in .one attachments. See how they work, what Microsoft now blocks and how to defend.

Updated 2 Min Read
microsoft onenote vulnerability

OneNote malware campaigns use .one notebook files to deliver malware through email attachments. The attacker hides a malicious file under a fake button such as “Double Click to View File”, and it runs when the user clicks. Microsoft has since made OneNote block embedded files with dangerous extensions, but blocking .one files at the mail gateway and training staff still help.

How did OneNote files become a malware delivery format?

Since December 2022, in malware distribution campaigns targeting Windows systems, it has been observed that OneNote files are being used in addition to traditional Word, Excel, ISO, or ZIP files. Threat actors were using ISO files and password-protected ZIP archives to distribute malware after Microsoft disabled macros by default in Word and Excel Office documents. This was because Windows was vulnerable to a weakness that allowed it to bypass security warnings for files in ISO and 7-ZIP archives.

The fixing of this vulnerability by 7-Zip and Microsoft has led threat actors to look for another file format to use in attacks, and as a result, they started using the Microsoft OneNote file format. The campaign chain begins with threat actors creating a OneNote document that includes a design element with a ‘Double Click’ message to view the content.

Which ransomware do malware campaigns in Microsoft OneNote run?

The file appears to be a protected document, as shown above, but contrary to what is visible, a malicious software file that will run when the user double-clicks is hidden under the “Double Click to View File” message. In observed campaigns, it was determined that the software running in the background dropped various Ransomware malware, such as BlackBasta, onto the targeted system.

To avoid being targeted by campaigns using the aforementioned malicious OneNote attachments on Windows systems, it is recommended to:

  • Block the ‘.one’ file extension from secure mail gateways or mail servers,
  • Use Microsoft Office group policies to restrict the execution of malicious file attachments in OneNote files,
  • Use comprehensive security solutions, and
  • Educate organization personnel on this and similar attack methods.

Frequently Asked Questions.

How do attackers use OneNote files to deliver malware?

They send a .one file that hides a malicious file under a fake button such as "Double Click to View File". The file runs when the user double-clicks it.

Does Microsoft block dangerous files inside OneNote?

Yes. Microsoft says OneNote blocks embedded files with dangerous extensions, starting with version 2304 in April 2023. It does not apply to OneNote on Mac, Android, iOS, the web or OneNote for Windows 10.

Which MITRE ATT&CK techniques fit these campaigns?

MITRE describes T1566.001 as spearphishing emails with malicious attachments and T1204.002 as relying on a user to open a malicious file.

How can organizations reduce the risk from malicious OneNote files?

Block the .one extension at mail gateways, use Office policies to restrict embedded file types, and train staff. Microsoft's policy 'Block additional file extensions for OLE embedding' adds more blocked types.

Sources

  1. 1 MITRE ATT&CK: Spearphishing Attachment (T1566.001)
  2. 2 MITRE ATT&CK: Malicious File (T1204.002)
  3. 3 Microsoft Learn: OneNote blocks embedded files that have dangerous extensions
Share

In This Article

TermsThreat actor TermsRansomware TermsMalware

Where To Next.

All Security News Articles
In plain words · Glossary term Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Open → Keep reading · Article Adobe Acrobat Sign Abused in Redline Stealer Distribution Campaigns

How threat actors abuse Adobe Acrobat Sign signing requests to deliver Redline Stealer, how the lure reaches users, and what to do to stay…

Open → Keep reading · Article Critical RCE Alarm in Siemens Solid Edge Viewer Software

Siemens fixed CVE-2023-22669, a heap-based buffer overflow in Solid Edge Viewer DWG parsing that can let an attacker run code.

Open →

Knowledge HubMalware and tools