DocuSign hacking tool – Alert!

DocuSign has notified users earlier this week of a new hacking tool that is mimmicking their product. This tool is dropping malware into victims’ computer systems. The name of the tool is EtterSilent and it uses Microsoft documents that contain macros to launch its attack. See alert below.

ALERT: New malicious hacking tool impersonating DocuSign observed

04/06/2021 

DocuSign has been made aware of a new malicious document builder named EtterSilent that has been used to impersonate DocuSign to deliver malware to victims. The document builder creates Microsoft Office documents containing malicious macros or attempts to exploit a known Microsoft Office vulnerability (CVE-2017-8570) to download malware onto the victim’s computer. This activity is from malicious third-party sources and is not coming from the DocuSign platform. 

To date, the malicious documents have been observed to deliver many different malware families such as Trickbot, QBot, Bazar, IcedID and Ursnif. These types of maldocs are typically delivered to victims via phishing attacks. For more information on how to spot phishing, please see our Combating Phishing white paper.

The following Indicators of Compromise have been seen associated with this activity:

 m