The first week of September 2025 delivered a sobering reminder that cyber threats continue evolving faster than traditional defenses can adapt. Russian APT28 deployed a sophisticated new backdoor called NotDoor, two actively exploited Android zero-days received emergency patches, and critical infrastructure vulnerabilities in platforms like Sitecore exposed years-old configuration weaknesses. For cryptocurrency users and blockchain projects navigating a market where Bitcoin holds above $110,000, these developments underscore an essential truth: security is not a product but a practice.
The Threat Landscape
On September 6, 2025, cybersecurity researchers documented APT28’s deployment of NotDoor, a VBA macro-based backdoor targeting Microsoft Outlook. Unlike conventional malware that relies on executable payloads, NotDoor hides within legitimate Office document macros and monitors incoming emails for specific trigger words. When a trigger is detected, the backdoor establishes a persistent command-and-control channel—entirely through built-in business application features.
This “living-off-the-land” approach means NotDoor generates no obvious malware signatures. Traditional antivirus products scan for known malicious code patterns, but NotDoor uses Outlook’s own macro execution engine. Security tools see normal application behavior, not an attack.
Simultaneously, Google patched two actively exploited Android zero-days—CVE-2025-38352 and CVE-2025-48543. The first exploits a race condition in the Linux kernel’s POSIX CPU timers for local privilege escalation. The second targets Android Runtime’s memory management to escape application sandboxes. Both require no user interaction and can be chained together for complete device compromise. For the millions of crypto users who manage wallets on Android devices, these vulnerabilities represent a direct threat to private keys and transaction signing.
Core Principles
Effective security in 2025 demands adherence to several non-negotiable principles. First, assume breach: operate under the presumption that some percentage of your environment is already compromised. This mindset shift drives defensive architecture rather than reactive firefighting.
Second, enforce least privilege rigorously. Every application, user account, and automated process should have access only to what it needs—nothing more. APT28’s NotDoor exploits environments where Outlook macros run unrestricted, a privilege that most users never need.
Third, segment your digital life. Cryptocurrency holdings should exist on dedicated devices or at minimum within isolated environments. The Android zero-days demonstrate that a single compromised device can expose everything running on it—from banking apps to crypto wallets.
Tooling & Setup
Building a robust security posture requires specific tools configured correctly. Start with hardware security keys (YubiKey or similar) for two-factor authentication across all exchange accounts and email. Hardware keys resist phishing attempts that can compromise software-based 2FA.
For crypto-specific protection, use hardware wallets for any holdings exceeding what you can afford to lose. Devices like Ledger or Trezor keep private keys isolated from internet-connected systems, rendering software-based key extraction attacks ineffective.
On mobile devices, immediately apply the September 2025 Android security patches addressing CVE-2025-38352 and CVE-2025-48543. Enable Google Play Protect and consider using Android’s work profile feature to isolate crypto applications from general-use apps.
For email security, disable macro execution in Outlook entirely unless your organization explicitly requires it. Enable advanced phishing protections in Microsoft 365, and configure mail flow rules to flag or quarantine emails from newly registered domains.
Ongoing Vigilance
Security is not a set-and-forget configuration. Establish a monthly review cadence for all security settings, access logs, and device firmware updates. Monitor certificate transparency logs for unauthorized certificates issued for your domains—a technique that can indicate supply chain compromise.
For organizations running blockchain infrastructure, implement real-time monitoring of smart contract interactions. Unusual patterns in approval transactions or unexpected contract interactions can indicate that a supply chain compromise—like the npm attack that struck days later—has reached your users.
Keep emergency response plans current and tested. Know the procedure for freezing accounts, rotating credentials, and communicating with stakeholders if a breach occurs. The hour following a security incident determines whether it becomes a minor incident or a catastrophic failure.
Final Takeaway
The convergence of state-sponsored threats like APT28’s NotDoor, platform-level zero-days in Android, and enterprise software vulnerabilities in Sitecore creates a threat environment where no single defensive measure suffices. Security must be layered, proactive, and continuously maintained. For cryptocurrency users managing assets worth hundreds of thousands of dollars at current market prices, the investment in proper security hygiene pays dividends far exceeding any hardware or software cost. The threats will keep evolving—your defenses must evolve faster.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
notdoor vba macro on outlook sounds nasty especially with bitcoin over 110k
NotDoor hiding in Outlook macros reading trigger words is clever. no executable payload means most EDR tools wont flag it. living off the land at its finest
Pavel Kriz NotDoor using trigger words in incoming emails to activate C2 is clever. the channel is the inbox itself, no external connection needed
Pavel Kriz trigger words in incoming emails activating C2 through the inbox itself. no external connection, no payload, just VBA macros reading mail. APT28 is playing a different game entirely
The amount of DeFi exploits is still way too high
Bug bounties are the most cost-effective security investment
The industry needs standardized security audit frameworks
SatoshiMoto standardized audit frameworks exist. the problem is 90% of DeFi protocols skip them or get rubber-stamp audits from no-name firms
Multi-sig wallets should be the default for everyone in crypto
BlockBuster88 multi-sig as default wont happen until hardware wallet UX improves. ledger and trezor make it possible but setup friction kills adoption
multi-sig should be default but UX is still terrible. hardware wallet integration helps but the setup friction keeps most people on single-key
sig_check_ agreed on UX. we ran a pilot with 12 people and 8 of them locked themselves out of multi-sig within a month
multi-sig as default won’t happen until UX stops being a landmine. single-key has wallet is the default because setting up multi-sig feels like defusing a bomb
living off the land with no signatures is exactly why multi layer matters now
BTC at $110k while state actors deploy outlook backdoors. the more valuable crypto gets the more sophisticated the attacks become. multi layer security isnt optional anymore
BTC at 110k while APT28 deploys outlook backdoors is peak crypto irony. the money funds the attacks that steal the money
This explains some recent market moves that haven’t made sense until now
APT28 deploying VBA macros in 2025 while BTC is at 110k. the gap between security tools and threats is wider than the blockchain hype
apt_vet_ VBA macros in 2025 while BTC sits at 110k. state actors dont need zero days when a word doc with macros still works on 60 percent of enterprise machines
macro_malware_ 60% of enterprise machines still running macros enabled Office is the real scandal here. Microsoft warned about this in 2017
60% of enterprise machines still running macros enabled in 2025 is genuinely shocking. Microsoft has been warning about this since 2017 and IT departments just keep clicking allow
completely missed that angle until i read your comment
SatoshiMoto is right about audit frameworks. 90% of DeFi protocols skip them completely. ‘decentralized’ is just code for unregulated
This is exactly the kind of project that deserves
NotDoor reading trigger words from incoming emails to fire up C2 through VBA macros is genuinely next level tradecraft. no payload, no external connection, just office being office