NotDoor: A New Backdoor by Russia’s APT28 Is Hiding in Microsoft Outlook Macros

NotDoor is a new backdoor campaign attributed to APT28, the Russia-linked threat group also known as Fancy Bear, according to LAB52. The malware, implemented as a VBA macro for Microsoft Outlook, monitors incoming emails for a trigger word and, when detected, can exfiltrate data, upload files, or execute commands remotely.

A DLL side-loading technique uses the legitimate Microsoft OneDrive.exe to load a malicious DSPICLI.dll and install the NotDoor VBA project, with macro protections then disabled to evade security controls, LAB52 explains. The loader runs three Base64-encoded PowerShell commands to copy the backdoor into Outlook’s VBA project folder, perform a DNS verification against a webhook[.]site domain tied to the victim’s username, and perform HTTP beaconing.

Persistence is achieved by editing registry keys to enable macros on boot and suppress Outlook dialog messages, making detection harder. Once installed, NotDoor relies on Outlook events to activate on startup or when new mail arrives, with the macro code heavily obfuscated and capable of commands such as copying, executing, exfiltrating via attachments, and uploading files to the victim’s machine, including sending files to a ProtonMail address if present.