State-sponsored hacking groups are trying a new file format to bypass security filters. Proofpoint's latest research shows APTs from China, Russia and India have started using Rich Text Format (RTF) files in template injection attacks—a technique previously confined to Microsoft Office documents. The shift means some security tools tuned for Word and Excel lures may miss RTF-based attacks landing in your inbox.
If your team handles sensitive project data or works with international clients, this warrants a look at your email security posture.
Quick take
- Three APT groups—TA423 (China), Gamaredon (Russia) and DoNoT (India)—are actively using RTF template injection
- Attackers embed malicious code inside RTF files that fetch a template from a remote server when opened
- DoNoT launched its first attacks in April, with activity continuing until July; TA423 targeted Malaysian energy firms through September
- Gamaredon used RTF lures mimicking Ukrainian government documents in October
- Proofpoint expects financially motivated threat actors to adopt the technique next
What RTF Template Injection Actually Does
Template injection isn't new. Attackers have used it with Office files for years—sending Word docs that pull malicious content from a remote template when opened. The technique works because the initial file looks clean; the malware loads afterward.
The new wrinkle is the file format. RTF files, often seen as legacy and low-risk, also support remote templates. Proofpoint found that threat actors are now crafting RTF documents with lures tailored to their targets, embedding a reference to a malicious template hosted elsewhere, and sending them via spear-phishing.
When a victim opens the RTF file and clicks "Enable editing" or "Enable content" (a prompt that blocks automatic execution in theory but rarely in practice), the template loads and runs the payload. The attack chain looks clean to many email security filters that flag malicious Office macros but haven't expanded to RTF.
Who Got Hit and How
DoNoT started registering domains for the campaign in March, with actual attacks launching in April. The group kept deploying RTF template injection through July before pausing.
TA423, the Chinese group, ran attacks into late September, focusing on Malaysian energy companies with ties to deepwater energy research. The sector specificity suggests intel-gathering goals rather than broad cybercrime.
Gamaredon, linked to Russia's FSB intelligence service, jumped in during October with RTF files disguised as Ukrainian government documents. That aligns with the group's documented focus on Ukrainian targets.
Who Should Care About This Development
| Threat Actor Type | Risk Level | Why They Should Pay Attention |
|---|---|---|
| Energy & maritime sector | HIGH | TA423's targeting of deepwater research suggests sector-specific intel-gathering operations |
| Government contractors | HIGH | State-sponsored groups prioritize high-value targets with sensitive project data |
| Professional services firms | MEDIUM | Project briefs, contracts and deliverables travel via email as attachments—prime lure material |
| Healthcare & critical infrastructure | MEDIUM | Gamaredon's FSB links indicate interest in strategic sectors during geopolitical tensions |
| General businesses | LOWER | Financially motivated adoption will broaden the attack surface significantly |
The practical problem: most endpoint protection that blocks macro-based Office attacks hasn't caught up to RTF variants. Your email security may not flag these files, and users trained to watch for Word document warnings might not extend the same caution to RTF files.
What to Watch Next
The technique is straightforward to implement. RTF files are easy to generate, and the supporting infrastructure is already proven among state-sponsored groups. This means the method could spread rapidly once financially motivated attackers see it working.
Track whether email security vendors expand their detection to cover RTF files with external template references. Also monitor whether your organization's security stack can identify the network behavior when malicious templates are fetched—even if the file itself slips through initial scanning.
Key takeaways
- RTF template injection is live and actively used by three state-sponsored groups targeting specific sectors
- Email security tools tuned for Office macro attacks may miss RTF variants until vendors update detection
- User training needs to cover RTF files alongside Word and Excel as potential attack vectors
- Financial motivation means ransomware groups will likely adopt this technique once it proves effective
- Audit your email security rules to ensure RTF files with remote template references are flagged
Frequently asked questions
What is RTF template injection?
It's an attack where hackers embed malicious code inside RTF files that loads from a remote template when the victim opens the document and enables editing, bypassing security tools that focus on Office file formats.
Which threat groups are using RTF template injection?
Proofpoint identified three: TA423 (China), Gamaredon (Russia) and DoNoT (India), each targeting different sectors and regions with tailored lures.
When did these attacks start?
DoNoT registered domains in March and launched attacks in April; TA423 ran campaigns through September targeting Malaysian energy firms; Gamaredon joined in October with Ukrainian government decoys.
Does clicking "Enable editing" automatically run the malware?
The attack requires user interaction—clicking the enable button. However, years of social engineering have shown this isn't a reliable blocker, as users can be manipulated into clicking with convincing document designs.
Who else might start using this technique?
Proofpoint expects financially motivated threats, including ransomware and botnet operators, to adopt RTF template injection given its low complexity and proven effectiveness against existing defenses.