Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malware

APT28, the state-sponsored threat group tied to Russian intelligence, is described as weaponising Microsoft Outlook through a backdoor researchers call “NotDoor.” NotDoor is a VBA macro for Outlook that monitors incoming emails for a trigger word, enabling data exfiltration, file uploads, and command execution when detected, according to Lab52, the threat intelligence arm of S2 Grupo.

The group allegedly deploys the backdoor via a legitimate signed binary, OneDrive.exe, by loading a malicious DLL (SSPICLI.dll) to disable macro security and deliver the VBA macro into targeted networks. The loader then runs PowerShell commands encoded in Base64, including nslookup via a service called DNSHook, which Lab52 says has been used in previous campaigns.

NotDoor also supports multiple trigger strings, maintains persistent access, can send trigger emails to initiate exfiltration, and deletes the triggering email after activation. The piece notes it is unclear how NotDoor was first detected or how attribution to APT28 was established, with comments sought from S2 Grupo but not immediately answered. 3 September 2025