'We've seen them shift recently from leveraging macros to using URLs to OneDrive or Google Drive,' he says. Users of one notorious malicious program, known as Emotet, have already begun shifting tactics, he notes. 'They're testing out new ways of working around it because they're clearly not as successful now that Microsoft has made this change.' 'The adversaries are aware of it,' observes Tim Bandos, executive vice president of cybersecurity at Xcitium, a maker of an endpoint security suite. Other companies are seeing threat actors switching tactics because of Microsoft's move, too. 'But that doesn't mean the threat is eradicated or we shouldn't continue to remind users to be vigilant about opening files from untrusted sources.' 'It's a hugely important step Microsoft is taking to start blocking these macros by default, especially due to how invisible macros are to the majority of users,' adds Nathan Wenzler, chief security strategist at Tenable, a vulnerability scanning company. 'Seeing Microsoft really take some action on something that has been a massive threat vector for years is great.' Microsoft move makes adversaries less successful 'The defender community has been battling this for many years,' DeGrippo says. With the change, Microsoft explained in a company blog, users will receive a message that macro execution is blocked when they open files from sources not identified as trusted. At the beginning of July, it announced a temporary rollback of the move, but it reaffirmed the move on July 20. Microsoft announced its intention to block Office macros by default in October 2021. The threat actors got the message that this is coming and are stifling their use of macros against individuals and organizations.' 'We've seen a 1,600% increase over the past ten months or so around using other tactics aside from malicious Office macros. 'We've seen them switch their tactics away from leveraging malicious macros into other kinds of attacks like LNK files,' says Proofpoint Vice President for Threat Research and Detection Sherrod DeGrippo. In a blog posted today, the company noted its researchers have found that the use of macro-enabled attachments by threat actors has decreased approximately 66% between October 2021 and June 2022. Microsoft's decision to turn off Office macros by default has had a significant impact on the use of the mini-programs by hackers, according to enterprise security company Proofpoint.

Microsoft logo vector file