NotDoor

NotDoor is an Outlook-focused backdoor implemented as a malicious VBA macro for Microsoft Outlook and attributed in the provided reporting to APT28 (Fancy Bear/UAC-0001), a Russia-linked GRU-associated threat actor. It has been described as used in espionage campaigns targeting government, military, diplomatic, maritime, transport, and other organizations in Ukraine and across NATO-aligned or Eastern European countries. The malware is also referred to in the content as GONEPOSTAL, and some reporting notes MiniDoor as a stripped-down variant of NotDoor.

The malware is designed for long-term email intelligence collection rather than interactive command-and-control. Reported behavior includes monitoring Outlook mailboxes and incoming messages, using Outlook event handlers such as Application_MAPILogonComplete and Application_NewMailEx for execution, automatically forwarding sensitive emails and attachments, saving messages as .msg files, deleting trigger or processed emails, and purging evidence by setting DeleteAfterSubmit to True. Multiple sources in the content state that it monitored folders including Inbox, Drafts, and Junk, and forwarded collected mail to attacker-controlled addresses including chmilewskii@outlook.com, chmilewskii@proton.me, ahmeclaw2002@outlook.com, ahmeclaw@proton.me, and a.matti444@proton.me. Some reporting also states that NotDoor can exfiltrate data, upload files, and execute commands when triggered by predefined words or phrases in incoming email, including an analyzed trigger string of "Daily Report," and that it supports commands such as cmd, cmdno, dwn, and upl.

Installation and persistence behavior described in the content centers on Outlook macro abuse. NotDoor writes or installs a malicious VbaProject.OTM file in %APPDATA%\Microsoft\Outlook; one reported sample has SHA-256 7ccf7e8050c66eed69f35159042d8043032f8afe48ae1f51fce75ce2c51395f2. The malware or its loader modifies Outlook-related registry settings to weaken protections and ensure macro loading, including HKCU\Software\Microsoft\Office\16.0\Outlook\Security\Level set to 1 and HKCU\Software\Microsoft\Office\16.0\Outlook\LoadMacroProviderOnBoot set to 1. Additional reporting states it suppresses Outlook warning dialogs via Outlook options registry changes. One documented deployment chain used DLL side-loading through legitimate Microsoft OneDrive.exe to load a malicious SSPICLI.dll, which then ran Base64-encoded PowerShell to copy a payload from c:\programdata\testtemp.ini into VbaProject.OTM and verify execution via webhook.site DNS and HTTP callbacks. Reported hashes from that chain include SSPICLI.dll SHA-256 5a88a15a1d764e635462f78a0cd958b17e6d22c716740febc114a408eef66705 and testtemp.ini SHA-256 8f4bca3c62268fff0458322d111a511e0bcfba255d5ab78c45973bd293379901.

In the 2026 reporting, NotDoor appears as one branch of a broader APT28 exploitation chain leveraging CVE-2026-21509 in malicious Office documents. That chain is described as using spear-phishing with weaponized RTF/DOC files, embedded OLE objects, and WebDAV retrieval of follow-on payloads, culminating either in NotDoor or in other implants such as Covenant Grunt, BeardShell, or related loaders. The content also notes associated artifacts and behaviors around this campaign, including Outlook macro creation, registry modification, and suspicious file writes, which were used by Splunk detections and datasets focused on NotDoor malware execution.