{"id":833,"date":"2023-03-20T14:13:08","date_gmt":"2023-03-20T14:13:08","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/onenote-emotet\/"},"modified":"2026-11-04T08:50:14","modified_gmt":"2026-11-04T08:50:14","slug":"onenote-emotet","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/onenote-emotet\/","title":{"rendered":"Oprezno s OneNote privicima! Koriste se za \u0161irenje Emoteta."},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Nakon tri mjeseca bez aktivnosti, ponovno je pokrenuto \u0161irenje Emoteta.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ovaj malware se dosad \u0161irio najvi\u0161e putem Word i Excel dokumenata sa zlonamjernim macro naredbama. Otkako su uvedene za\u0161titne mjere koje onemogu\u0107uju pokretanje macro naredbi iz takvih dokumenata, efikasnost njegovog \u0161irenja se zna\u010dajno smanjila.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/emotet-malware-now-distributed-in-microsoft-onenote-files-to-evade-defenses\/\">BleepingComputer<\/a> je predvidio da \u0107e zato po\u010deti koristiti OneNote privitke, budu\u0107i da tako mogu zaobi\u0107i Microsoftove sigurnosne mjere.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Budite na oprezu za ovu vrstu prijevare. Napada\u010di su primijetili da su korisnici o\u010dito nau\u010dili prepoznavati zara\u017eene Word i Excel dokumente te se po\u010dinju slu\u017eiti ostalim programima, a <strong>OneNote omogu\u0107ava lukavo skrivanje zlonamjernih datoteka.<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a088676f6&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a088676f6\" class=\"wp-block-image size-large is-resized wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/03\/image.png\" alt=\"\" class=\"wp-image-110752\" width=\"566\" height=\"308\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: BleepingComputer<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Prilikom pokretanja takvog dokumenta pojavljuje se sko\u010dni prozor s porukom <em>\u201eThis Document is protected\u201c<\/em> (Ovaj dokument je za\u0161ti\u0107en\u201c).<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a08867c17&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a08867c17\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/03\/image-1.png\" alt=\"\" class=\"wp-image-110753\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: BleepingComputer<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>OneNote dopu\u0161ta kreiranje dokumenata s elementima koji preklapaju ugra\u0111eni dokument<\/strong>. Bez obzira na to \u0161to se preko dokumenta nalazi neki element, ako se dvostruko klikne na podru\u010dje gdje se nalazi takav dokument, on se pokre\u0107e.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">U ovoj kampanji, akteri su sakrili zlonamjerni VBScript naziva \u201e<em>Click.wsf\u201c<\/em> ispod gumba pregleda (\u201eView\u201c).<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a088680df&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a088680df\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/03\/image-2.png\" alt=\"\" class=\"wp-image-110754\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: BleepingComputer<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">VBScript preuzima <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/windows-client\/deployment\/dynamic-link-library\">DLL<\/a> s udaljenog, kompromitiranog web sjedi\u0161ta i izvr\u0161ava ga.<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a0886853f&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a0886853f\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/03\/image-3.png\" alt=\"\" class=\"wp-image-110755\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: BleepingComputer<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Iako \u0107e se prikazati upozorenje - da poku\u0161avate pokrenuti ugra\u0111eni dokument - iz iskustva znamo da <strong>ve\u0107ina ljudi klikne \u201eOK\u201c bez da pro\u010dita obavijest koja im se prikazala.<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a088689a8&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a088689a8\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2023\/03\/image-4.png\" alt=\"\" class=\"wp-image-110756\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>Izvor: BleepingComputer<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Nakon \u0161to kliknete \u201eOK\u201c, pokre\u0107e se VBScript, preuzima Emotet kao DLL, sprema ga u Temp mapu i pokre\u0107e ga.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tada Emotet po\u010dinje raditi u pozadini va\u0161eg ra\u010dunala, krade podatke i kontakte te \u010deka daljnje upute C&amp;C servera.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kako bi nas za\u0161titili od ovakvih napada, stru\u010dnjaci u Microsoftu su najavili poja\u010danu za\u0161titi OneNote-a, a dotad Windows admini mogu blokirati ugra\u0111ene datoteke (sve ili odre\u0111enih ekstenzija) u OneNote datotekama.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>#SurfajSigurnije<\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>Nakon tri mjeseca bez aktivnosti, ponovno je pokrenuto \u0161irenje Emoteta. Ovaj malware se dosad \u0161irio najvi\u0161e putem Word i Excel dokumenata sa zlonamjernim macro naredbama. Otkako su uvedene za\u0161titne mjere koje onemogu\u0107uju pokretanje macro naredbi iz takvih dokumenata, efikasnost njegovog \u0161irenja se zna\u010dajno smanjila. BleepingComputer je predvidio da \u0107e zato po\u010deti koristiti OneNote privitke, budu\u0107i [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1312,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-833","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=833"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/833\/revisions"}],"predecessor-version":[{"id":1314,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/833\/revisions\/1314"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1312"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=833"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=833"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}