Hello and welcome to the Thursday, August 14th,

2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

This episode is brought to you by the sands.edu graduate certificate program in Purple Team

Operation.

Yesterday we talked about new Microsoft patches.

Well, sadly, all vulnerabilities appear to be still around, at least around enough

for attacks to still take advantage of them.

Xavier came across this little bit odd Excel spreadsheet, the extension is dotxel AM, which

usually hints at like a macro file, but macros were not the problem here. Instead, it just exploited an old

2017 vulnerability, the good old equation editor vulnerability. So apparently it's still

enough of it around in order for attackers to still give it a try ever so often.

As Xavier points out, he keeps an old virtual machine around just for that purpose.

I think in most corporate environment, I hope it's not that easy to find these old systems

still running, but I have been surprised before.

The payload here is then essentially just triggering a download of an executable

that is being run on the victim's system, and this executable is an information stealer

that then exfiltrates data via email directly to an attacker's

mail server. Another sort of not super common technique

given that outbound email via random mail services often blocked.

So maybe more something going after home users or the like versus more

enterprise users. And talking about vulnerabilities and Microsoft's Patch Tuesday. There's one

...