---
title: New Excel-Based Attack and How It Works
description: Microsoft details a new Excel attack that auto executes if certain preferences are present. The new Excel macro attack and how it works.
---

[SecureWorld News ](https://www.secureworld.io/industry-news)

# [New Excel-Based Attack and How It Works](https://www.secureworld.io/industry-news/excel-based-cyber-attack)

 Written by [SecureWorld News Team](https://www.secureworld.io/industry-news/author/secureworld-news-team) | Mon | Jun 24, 2019 | 11:04 PM Z

If your organization has macros enabled, you may want to change that after a recent discovery by Microsoft's Security Intelligence Team.

A new attack starts with an Excel file that takes advantage of enabled macros to run an attack. Here is what Microsoft [posted in a series](https://twitter.com/MsftSecIntel/status/1141858904365649922) of tweets:

"Anomaly detection helped us uncover a new campaign that employs a complex infection chain to download and run the notorious FlawedAmmyy RAT directly in memory. The attack starts with an email and .xls attachment with content in the Korean language.

When opened, the .xls file automatically runs a macro function that runs msiexec.exe, which in turn downloads an MSI archive. The MSI archive contains a digitally signed executable that is extracted and run, and that decrypts and runs another executable in memory.

This executable then downloads and decrypts another file, wsus.exe, which was also digitally signed on June 19. wsus.exe decrypts and runs the final payload directly in memory. The final payload is the remote access Trojan FlawedAmmyy."

Microsoft claims that Office 365 ATP detects the email campaign in its current form.

[View full post](https://www.secureworld.io/industry-news/excel-based-cyber-attack)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "SecureWorld News Team"
  },
  "dateModified" : "2019-06-25T00:35:31.064Z",
  "datePublished" : "2019-06-24T23:04:43Z",
  "headline" : "New Excel-Based Attack and How It Works",
  "image" : {
    "@type" : "ImageObject",
    "height" : 720,
    "url" : "https://info.secureworldexpo.com/hubfs/social-suggested-images/windows-1859187_1280.jpg",
    "width" : 1280
  },
  "mainEntityOfPage" : "https://www.secureworld.io/industry-news/excel-based-cyber-attack",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/2221756/Logos/SWE/SWE_logo_full-long_forWHITEbackgrounds.jpg",
      "width" : 304.46954
    },
    "name" : "SecureWorld News"
  }
}
```