Kasidet

Executive Summary

Kasidet is a Windows backdoor delivered through malicious VBA macros that installs persistence via registry run keys and establishes encrypted communication with a remote C2 server. It provides attackers remote command execution, credential harvesting, and potential system tampering. The macro‑based delivery vector enables Kasidet to exploit user behavior and bypass many endpoint defenses that filter only network traffic.

Kasidet is a lightweight Windows backdoor that is primarily delivered through malicious VBA macros embedded in compromised Office documents. Once the user opens the infected file and enables the macro, it executes code designed to establish persistence by creating registry entries (often under HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and download an additional payload from a remote command-and-control server. After successful installation, Kasidet establishes an encrypted channel to its C2 infrastructure, providing attackers with remote command execution capabilities. The backdoor is capable of collecting system information (OS version, machine GUID), exfiltrating credentials stored on the host, and modifying or deleting files to cover its tracks. It mimics legitimate application processes and utilizes obfuscation techniques to evade signature‑based detection. Kasidet’s deployment via VBA macros places it in the same threat class as other macro-based malware such as Emotet and TrickBot, which allows attackers to piggyback on everyday user workflows. The use of HTTPS for payload delivery further increases survivability by evading basic network security controls that rely on unencrypted traffic inspection.

Key Capabilities

• Deploys additional payload via VBA macros
• Creates registry Run key for persistence
• Establishes encrypted C2 channel (HTTPS/TLS)
• Exfiltrates system and credential data
• Provides remote command execution
• Employs obfuscation/masquerading to evade detection

ATT&CK Techniques

Recommended Actions

• Block macro-enabled Office documents from untrusted sources
• Implement email filtering to detect suspicious VBA macros
• Deploy endpoint protection with behavior‑based anomaly detection
• Regularly patch Windows and Office to reduce macro exploitation risk
• Use application whitelisting to prevent unknown executables running

Suggested Tags