Hackers Use MS Excel Macros for Multi-Stage Malware: Legal Remedies and Cyber Recourse Under Indian Law

The Anatomy of an Advanced Cyber Threat

Recent threat intelligence reports from Ukraine revealed a sophisticated cyber campaign where state-aligned threat actors weaponized Microsoft Excel documents to orchestrate multi-stage malware infections. Disguised as legitimate financial spreadsheets, operational templates, or critical official communiqués, these malicious workbooks rely on Visual Basic for Applications (VBA) macros to bypass perimeter defenses and quietly deploy secondary payloads into target networks.

While this attack surfaced in Eastern Europe amidst ongoing geopolitical conflict, macro-based execution remains one of the most prolific attack vectors globally. In India's financial capital, Mumbai, and the expanding industrial corridors of Thane and Mira-Bhayandar, corporate entities, micro, small, and medium enterprises (MSMEs), and professional firms face an identical risk profile.

Understanding how these multi-stage attacks execute and knowing the applicable legal recourses under Indian law—specifically the Information Technology Act, 2000, and the newly enacted Bharatiya Nyaya Sanhita (BNS), 2023—is critical for securing your infrastructure and enforcing legal liability.

Technical Explainer: How Macro-Based Multi-Stage Malware Operates

Unlike traditional malware, where an executable file immediately triggers an alert from modern antivirus software, multi-stage attacks separate the delivery, exploitation, and payload execution phases into distinct steps.

1. Social Engineering and Phishing

Attackers distribute spear-phishing emails containing an attached .xlsm or .xls file. The email often uses urgent lures—such as overdue tax demand notices, bank transfer confirmations, or regulatory compliance audits—to induce the recipient to open the attachment.

2. Execution via VBA Macros

Upon opening, Microsoft Excel defaults to protected view and alerts the user that macros have been disabled. Attackers use deceptive graphic prompts (e.g., "Enable Content to decrypt this document") to trick users into manually enabling macros. Once enabled, the embedded VBA script executes automatically without triggering visible windows.

3. Multi-Stage Droppers and LOLBins

The VBA macro typically acts merely as a "dropper" or initial-stage stager. It leverages built-in administrative tools—known as Living off the Land Binaries (LOLBins)—such as certutil.exe, PowerShell, or Windows Command Line (cmd.exe). These tools download an encoded binary or script from a command-and-control (C2) server.

4. Persistence, Data Exfiltration, and Ransomware

In subsequent stages, the payload executes in memory to evade detection, establishes persistent registry keys, harvests employee credentials, maps internal networks, and either exfiltrates sensitive commercial data or deploys ransomware to lock institutional files.

The Indian Legal Framework: Addressing Cyber Sabotage and Data Breaches

When a workstation or corporate network in India is compromised by macro-driven malware, the act triggers civil liabilities, statutory reporting mandates, and criminal offenses under several statutes.

1. The Information Technology Act, 2000 (IT Act)

Section 43 (Damage to Computer System): Provides for civil damages and compensation if an individual introduces or causes to be introduced any computer contaminant or computer virus into any computer system without permission.
Section 66 (Computer-Related Offences): Penalizes any act specified in Section 43 done dishonestly or fraudulently, imposing imprisonment of up to three years or a fine of up to five lakh rupees, or both.
Section 66C and 66D: Applies where attackers spoof sender identities or steal digital signatures, passwords, and access credentials.
Section 43A and Future Enforcement under DPDP Act 2023: Entities failing to implement reasonable security practices face liability if corporate negligence results in wrongful loss or unauthorized exposure of sensitive client or employee data.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the replacement of the Indian Penal Code, digital offenses are concurrently prosecuted under the BNS:

Section 318 (Cheating): Addresses fraudulent misrepresentation through deceptive emails or phishing tactics designed to induce victims into running malicious software.
Section 316 (Criminal Breach of Trust): Relevant if an insider or outsourced IT administrator knowingly compromises corporate infrastructure or aids malicious macro dissemination.
Section 308 (Extortion): Invoked in cases where the multi-stage attack culminates in ransomware, with actors demanding cryptocurrency or monetary payments to unlock or withhold data.

3. Mandatory Reporting to CERT-In

Under the Cyber Security Directions issued by the Indian Computer Emergency Response Team (CERT-In), corporate entities, system intermediaries, and service providers must report cybersecurity incidents (including malware infections, targeted scanning, unauthorized access, and ransomware attacks) within six hours of noticing or being notified of the breach.

Digital Evidence Preservation under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

In cyber litigation, capturing and admitting digital evidence correctly is paramount. The Indian Evidence Act of 1872 has been replaced by the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

Section 61 and Section 63 of BSA: Electronic records now directly hold primary or secondary status under explicit statutory rules. Section 63 sets out the strict criteria and electronic certificate requirements (replacing the erstwhile Section 65B of the Indian Evidence Act) needed to introduce log files, server dumps, email headers, and malware samples into court proceedings.
Chain of Custody: To ensure evidence withstands judicial scrutiny, victims must maintain a strict, forensically audited chain of custody from the moment the compromised Excel file is isolated until disk images are analyzed by an authorized digital forensics examiner.

Action Plan: How Victims in Mumbai, Thane, and Mira Road Can Respond

If your organization or personal system has been targeted by macro malware or experienced an unauthorized intrusion:

Isolate the Affected Systems Immediately: Disconnect compromised endpoints from your local network (LAN and Wi-Fi) to stop secondary stages from reaching other servers. Do not format the machine; preserve RAM states and hard drives.
Preserve Forensic Artefacts: Retain original email copies (with raw headers intact), the exact .xlsm file, firewall logs, DNS query histories, and proxy traffic records.
File an Official Complaint:
- National Portal: Lodge a complaint immediately at cybercrime.gov.in.
- Local Cyber Police Stations (Mumbai): File an FIR or written complaint at the specialized Cyber Police Stations in the Mumbai Police jurisdiction (e.g., BKC Cyber Crime Police Station, or the Regional Cyber Cells in South, Central, East, West, and North Regions).
- Thane and Mira-Bhayandar: If located in Thane or the Mira-Bhayandar, Vasai-Virar (MBVV) Police Commissionerate, approach the dedicated Cyber Crime Cell at the Police Commissionerate Office.
Issue Section 43/66 Petitions: Where financial loss or systemic harm has occurred due to negligence or target-focused sabotage, victims can initiate adjudication proceedings before the State IT Secretary (Adjudicating Officer under the IT Act) to claim damages.

Frequently Asked Questions (FAQs)

Can opening an Excel attachment without enabling macros infect my computer?

Generally, modern versions of Microsoft Excel open internet-sourced attachments in "Protected View," which restricts macro execution and sandbox escapes. Simply previewing the document is unlikely to trigger the payload; infection almost always requires the user to manually click "Enable Content" or bypass warnings, allowing the embedded VBA script to run.

What immediate legal liability does a business face if customer data leaks due to malware?

Under Section 43A of the IT Act (and the corresponding obligations under the Digital Personal Data Protection Act, 2023), companies that fail to maintain reasonable security procedures may be held liable to compensate individuals for wrongful loss. Additionally, failure to report the incident to CERT-In within six hours can attract statutory penalties.

How does the Bharatiya Sakshya Adhiniyam, 2023 affect electronic evidence in cyber crimes?

Under Section 63 of the BSA (which replaces Section 65B of the Indian Evidence Act), electronic records—including email headers, malware logs, and hard-drive images—require proper electronic authentication via a statutory certificate executed by the custodian of the computer system or a certified forensic expert to be admissible in an Indian court.

Can we legally trace an overseas threat actor using Indian legal mechanisms?

While Indian law enforcement can register an FIR under the IT Act and BNS, international threat groups require cross-border investigation. Indian authorities cooperate with foreign agencies through Interpol notices and Mutual Legal Assistance Treaties (MLATs). Domestically, legal action can also target local proxies, intermediaries, or money-mule bank accounts involved in collecting ransom funds.

Protecting Your Legal and Digital Interests with APS Law

Cyber incidents demand a coordinated technical and legal response. From navigating complex compliance obligations under the IT Act and CERT-In directions to filing formal complaints with cyber cells across Mumbai, Thane, and Mira Road, timely legal counsel is essential to mitigating liability and securing redress.

If your organization has suffered an intrusion or requires assistance with digital evidence compliance under the Bharatiya Sakshya Adhiniyam, request a consultation with APS Law today.