Squirrelwaffle

Description

Squirrelwaffle is a malware loader distributed as malicious Office documents in spam campaigns. When a recipient enables macros in the document, a Visual Basic script downloads and executes further malicious files, giving its operators an initial foothold and a channel for delivering additional malware. Its operators also used DocuSign branded lures to trick users into enabling macros.

Stats

First seen: March 2022
Last seen: September 2026

Also known as

SquirrelWaffle

MITRE ATT&CK techniques

21 techniques across 7 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.001PowerShell
- T1059.003Windows Command Shell
T1204User Execution
- T1204.001Malicious Link
- T1204.002Malicious File

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.002Software Packing
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion

TA0007 Discovery

T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1082System Information Discovery

TA0009 Collection

T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Alert name variants

Alert Name	Engine
Document-Excel.Trojan.Squirrelwaffle	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.Squirrelwaffle	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.Squirrelwaffle	ATP Sandbox Adv. Heuristics
Win32.Dropper.SquirrelWaffle	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Doc.Dropper.SquirrelWaffle download attempt	IPS-SWG