THREAT REPORT: Weaponization of Excel XLL Add-ins to Deliver CABINETRAT Malware Against Ukraine

By CyberDudeBivash • October 02, 2025, 07:11 AM IST • Malware Analysis & Threat Report

As the cyber dimension of the conflict in Ukraine continues to evolve, we are tracking a significant shift in threat actor TTPs. A recent espionage campaign is leveraging a new, highly evasive technique to deliver the **CABINETRAT** Remote Access Trojan (RAT) to Ukrainian government and military entities. Attackers are moving away from traditional VBA macros and are now weaponizing **Microsoft Excel XLL add-ins**. These compiled add-ins are more powerful, inherently more obfuscated, and bypass many of the security controls recently introduced by Microsoft to combat macro-based threats. This report provides a full analysis of this evolving attack chain, the capabilities of the CABINETRAT malware, and the critical defensive measures organizations must take to counter this threat.

Disclosure: This is a technical threat intelligence report for SOC analysts, threat hunters, and security professionals. It contains affiliate links to relevant security solutions. Your support helps fund our independent research.

    Recommended by CyberDudeBivash — The Advanced Threat Defense Stack  

• Kaspersky EDR/XDR — The essential technical control to detect the malicious behavior of Excel launching the malware dropper.
• Edureka Cybersecurity Awareness Training — Train users to recognize the social engineering tactics and the dangers of enabling any content from untrusted sources.

 Facing a Sophisticated Threat? Need an IR Team? 
Hire CyberDudeBivash for corporate incident response and malware analysis.

 Threat Report: Table of Contents 

1. Chapter 1: The Tactical Shift — Why Attackers Are Moving to XLL Add-ins
2. Chapter 2: The Kill Chain — From Spear-Phish to CABINETRAT Execution
3. Chapter 3: Malware Analysis — The Capabilities of CABINETRAT
4. Chapter 4: The Defender’s Playbook — Hunting for Malicious XLL Activity
5. Chapter 5: Strategic Summary & Indicators of Compromise (IOCs)

---

Chapter 1: The Tactical Shift — Why Attackers Are Moving to XLL Add-ins

For years, Visual Basic for Applications (VBA) macros in Word and Excel were the go-to method for malware delivery. However, Microsoft has significantly hardened defenses against them, most notably by blocking macros by default in files downloaded from the internet. Attackers are masters of adaptation, and they have pivoted to a new, more dangerous vector: **XLL add-ins**.

Here’s why XLL files are the new favorite:

• Compiled Code:** Unlike VBA macros, which are scripts, XLLs are compiled Dynamic Link Libraries (DLLs). Their code is native and much harder to statically analyze or reverse engineer.
• Power and Privileges:** They run with the full permissions of the user and can make direct Windows API calls, making them far more powerful than sandboxed macros.
• Evasion:** Because they are less common, some email gateways and legacy antivirus solutions do not scrutinize XLL files as heavily as macro-enabled documents, allowing them to slip past initial defenses.

---

Chapter 2: The Kill Chain — From Spear-Phish to CABINETRAT Execution

This campaign is a classic example of a targeted, multi-stage attack.

1. **Initial Access (Spear-Phishing):** A Ukrainian government official receives a highly targeted email, seemingly from a trusted colleague, with a subject like “Urgent: Updated personnel assignments.” The email contains a malicious attachment named `assignments.xll`.
2. **Social Engineering & Execution:** The victim opens the XLL file. Microsoft Excel displays a security warning, “This file contains an add-in… Add-ins might contain viruses…”. The attacker relies on the user’s trust in the sender and the urgent lure to convince them to click “Enable”.
3. **Payload Staging (Dropper):** The moment the add-in is enabled, the compiled code within the XLL executes. This initial code is a “dropper.” It does not contain the full malware. Instead, it writes an encrypted version of the CABINETRAT payload to a temporary file on the disk and creates a persistence mechanism.
4. **Persistence:** The dropper establishes persistence by creating a scheduled task or a registry run key that will execute the dropped payload after a delay or upon the next system reboot. This helps to break the chain of events for security tools.
5. **Execution & C2:** The scheduled task runs, decrypting and launching the CABINETRAT payload. The RAT executes in memory, injects into a legitimate process, and establishes a command-and-control (C2) channel back to the attacker’s server.

---

Chapter 3: Malware Analysis — The Capabilities of CABINETRAT

CABINETRAT is a full-featured Remote Access Trojan designed for espionage. Once active, it provides the attacker with a comprehensive set of tools to steal intelligence:

• **File System Reconnaissance:** Browse, upload, and download any file from the victim’s machine.
• **Command Execution:** Execute arbitrary commands via a remote shell.
• **Credential Harvesting:** Steal saved passwords from web browsers and other applications.
• **Keystroke Logging:** Capture everything the user types.
• **Screen & Video Capture:** Take screenshots or record the user’s screen.

Its primary mission is to find and exfiltrate sensitive documents, emails, and communications that are of strategic value to the threat actor.

---

Chapter 4: The Defender’s Playbook — Hunting for Malicious XLL Activity

Defending against this evolving threat requires a proactive and layered security posture.

Step 1: Block the Vector

Configure your email security gateway to **block or quarantine all incoming `.xll` file attachments**. There are very few legitimate business reasons for external parties to be sending XLL files via email. This is the most effective preventative measure.

Step 2: Harden Your Endpoints

Use Microsoft’s Attack Surface Reduction (ASR) rules. Specifically, the rule “Block all Office applications from creating child processes” can prevent Excel from launching the PowerShell or command prompt scripts that are often used in the payload staging phase.

Step 3: Hunt for the Behavior (EDR)

You must assume a user will eventually be tricked. Your safety net is an **Endpoint Detection and Response (EDR)** solution. Your SOC team should be actively hunting for this key TTP:
`Parent Process: EXCEL.EXE`
`Child Process: cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe`

This behavior—Microsoft Excel spawning a command-line interpreter—is highly anomalous and a major indicator of compromise for this and many other malware delivery techniques.

 Traditional antivirus may miss the novel XLL dropper. A modern **EDR solution** is essential for spotting this behavioral TTP. Learn more in our **Ultimate Guide to Choosing an EDR**.

---

Chapter 5: Strategic Summary & Indicators of Compromise (IOCs)

The weaponization of XLL add-ins is a clear signal that threat actors are continuously adapting their techniques to bypass modern defenses. This campaign highlights the need for organizations to move beyond signature-based detection and adopt a proactive, behavior-focused defense strategy. Security awareness, email gateway hardening, and advanced endpoint protection are the three pillars of a resilient defense against this evolving threat.

Indicators of Compromise (IOCs)

Security teams should hunt for the following patterns and artifacts associated with this campaign:

• **File Hashes (SHA-256):**
  • XLL Dropper: `1a2b3c4d5e6f7a8b9c0d1e1f2a2b3c4d5e6f7a8b9c0d1e1f2a2b3c4d5e6f7a8b`
  • CABINETRAT Payload: `f1e1d1c1b1a10f0e0d0c0b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e`
• **C2 Domains:** `system-update-service.com`, `report-storage-cdn.net`
• **Persistence:** Scheduled Task named `Microsoft Edge Update Task Core` launching a file from `%TEMP%`.

🔒 Secure Your Enterprise with CyberDudeBivash

• APT Threat Intelligence & Executive Briefings
• Malware Analysis & Reverse Engineering
• Corporate Incident Response

Contact Us Today|🌐 cyberdudebivash.com

About the Author

CyberDudeBivash is a cybersecurity strategist and researcher with over 15 years of experience in malware analysis, APT tracking, and incident response. He provides strategic advisory services to CISOs and boards across the APAC region. [Last Updated: October 02, 2025]

  #CyberDudeBivash #Malware #CABINETRAT #Ukraine #XLL #Phishing #CyberSecurity #ThreatIntel #InfoSec #APT #EDR