Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries

The Hacker News reports that the Russian state-sponsored group APT28 has been linked to a new Microsoft Outlook backdoor named NotDoor, deployed against multiple NATO‑country companies. NotDoor is a VBA macro for Outlook designed to monitor incoming emails for a trigger word, enabling data exfiltration, file uploads and command execution when detected, with activity described as using Base64‑encoded PowerShell commands and a Proton Mail address for data exfiltration.

According to LAB52 threat intelligence, the backdoor is delivered via DLL side‑loading from Microsoft’s OneDrive executable (onedrive.exe) to install a malicious DLL (SSPICLI.dll) and then the VBA backdoor, while macro protections are disabled. The malware stores TXT files in a staging folder at %TEMP%\Temp and can execute four commands—cmd, cmdno, dwn and upl—exfiltrating files by email as attachments or dropping new files to the victim, with the payload executed on Outlook startup or when a new email arrives.

The analysis notes a covert use of Outlook as a stealthy delivery and data exfiltration channel, with 360 Threat Intelligence Center highlighting multiple obfuscation layers and rapid infrastructure rotation to avoid detection.