While Hawkeye has been a product since 2013, the recent change in ownership at the end of 2018 has decided that change beyond just its capabilities is in order. Providing a business via a licensing model extends the longevity and security of a revenue source and maintains the sales relationship with minimal effort. Including a terms of service that forbids illicit use sheds a small degree of liability, but including a restriction against their product being scanned by antivirus software seems to negate any possible plausible deniability. These steps seem to be an effort to distance the provider from the “troubled youth” of the malware and legitimize it to some degree but utterly fails to actually reform it.
The malware itself is found in ongoing malware campaigns since mid 2018, before the regime change. The formula adheres to many of the usual suspects: vague emails about fiscal functions and duties that sound urgent, confirmations and audits of things that require oversight, general notices of company gatherings with details not contained in the body of the email, and other pedestrian and mundane pieces of bait for the weaponized Excel hook. Sometimes an RTF or Doc file is used for older campaigns and occasionally the malicious document is stored a few more steps away in a drobox or other file sharing location.
The current attacks use the CVE-2017-11882 vulnerability, a buffer overflow vulnerability in Excel’s equation editor. It triggers the memory handling error when the data sent for the font name is too long which then allows the attacker to execute arbitrary code on the victims machine with the victims level of privilege.
At this point the attacker downloads a payload from an attacker controlled server, which decompiles itself and retrieves a final payload which cements Hawkeye in the user’s system. The researchers found tools not used in the current campaign such as Anti-Virtual machine detection, USB drive infection, and others.
Hawkeye itself offers keylogging, systems monitoring, and other espionage tools as well as a way to exfiltrate data collected and technical support for as long as your license is valid. The latest campaign hinges on a vulnerability that has since been patched. As always, update your programs and be vigilant of any suspicious documents.