New ‘NotDoor’ Malware Targets Outlook Users for Data Theft and System Compromise

A new backdoor malware named NotDoor has been singled out as targeting Microsoft Outlook users to theft data and seize control of infected systems. Russian state‑sponsored hackers have been attributed to APT28, also known as Fancy Bear, with the group linked to Russia’s General Staff Main Intelligence Directorate (GRU) and active for more than a decade. The discovery was published by LAB52, the threat intelligence unit of Spanish cybersecurity firm S2 Grupo, according to LAB52’s analysis.

NotDoor is written in Visual Basic for Applications and monitors incoming emails for trigger words such as “Daily Report”; when detected, it activates to allow command execution and persistence, including Windows Registry modifications to disable macros and suppress prompts. It uses DLL side‑loading on OneDrive.exe to load malicious DLLs and exfiltrates temporary files to an attacker‑controlled email address (a.matti444@proton[.]me) before deleting them, with callbacks to a webhook site confirming compromise.

According to S2 Grupo, NotDoor has already compromised multiple companies across NATO member countries, highlighting both the threat’s stealth and the attackers’ evolving capabilities.