When ransomware actors shift away from macros, defenders lose the value of controls built only around Office documents and macro execution. The attack surface moves to file types that users may open more readily and that endpoint controls may not classify as risky by default. Security teams need layered inspection, attachment detonation, and user awareness that delivery methods can change faster than policy.
Why the Shift Away From Macros Changes Defender Assumptions
Moving from macro-laden Office documents to zipped JavaScript or ISO files is not just a packaging change. It changes which controls are effective at the edge, which file types trigger scrutiny, and where execution begins. The practical effect is that defenders can no longer rely on macro policy, Office-centric attachment filtering, or user training that only targets one delivery format.
That matters because ransomware operators are often testing for the least-observed path to code execution, not the most technically exotic one. If one file type becomes noisy or well-blocked, they pivot to another that still reaches a user inbox, passes through mail gateways, or is opened locally with enough trust to start the chain.
Related patterns show up in supply-chain and attachment abuse, including campaigns that use malicious JavaScript, compressed archives, and other non-Office containers to get past shallow inspection. For broader context on how malicious delivery shifts can expose downstream secrets and repositories, see Shai Hulud npm malware campaign and the GitHub Action tj-actions Supply Chain Attack.
When the attachment format changes, the defensive question also changes. Instead of asking only whether macros are disabled, teams need to ask whether their controls inspect archive contents, detect script execution paths, and treat mounted disk images or nested archives as suspicious by default. The format is part of the attack path, not just a container.
What Zipped JavaScript and ISO Files Let Attackers Do
Zipped JavaScript and ISO files each solve a different problem for the attacker. A zip archive can hide the real payload behind one or more layers of compression and naming tricks, while an ISO file can present itself as a benign disk image that users may mount or open with fewer alarms than a macro-enabled document.
That lets the ransomware group shift initial access away from Office-specific controls and toward user interaction patterns that are harder to normalize. In practice, the attacker is trying to move the first malicious step into a file type that is either less likely to be blocked outright or more likely to be trusted after a single click.
Delivery methods like this also create inspection gaps. Some mail and endpoint controls look at file extension, document metadata, or known risky Office behaviors, but those signals are weaker when the payload lives inside an archive, a nested object, or a mounted image. A more complete picture is often closer to what is described in the 52 NHI Breaches Analysis and the Ultimate Guide to NHIs, Key Challenges and Risks, where hidden exposure and delayed visibility are recurring failure modes in modern attack chains.
In threat terms, this is a familiar evasion pattern: reduce the defender’s confidence in static signatures, shift toward user-triggered execution, and exploit any blind spot between the email gateway, the sandbox, and the endpoint. The exact file type matters less than the fact that it changes what the control stack sees first.
How Defenders Should Adjust Their Attachment and Endpoint Strategy
Security teams should treat this as a control-design issue, not a one-off malware family quirk. The important adjustment is to inspect the full delivery chain: email ingress, archive expansion, file reputation, script execution, and any follow-on process creation. If the policy only flags Office macros, it is already behind the attacker’s delivery preferences.
What to verify: Confirm that your gateway and endpoint stack inspects nested archives, blocks or detonate-tests disk images, and records the child process lineage when a script file launches. If those telemetry points are missing, you will struggle to distinguish benign user activity from initial ransomware staging.
Decision rule: If a file type can deliver executable content or stage a loader, treat it with the same scrutiny as a macro document even if users perceive it as “just an attachment.” That means the classification should be based on execution potential and detonation behavior, not file familiarity.
What practitioners underestimate: User awareness still matters, but the message must be broader than “don’t enable macros.” People need to understand that archives and images can also be used to stage malicious code, and that a file looking ordinary is not evidence of safety.
Risk and Threat Considerations
Shifting to zipped JavaScript or ISO files increases the chance that an organisation’s controls are tuned to the wrong indicator, which creates a gap between policy and real attacker behavior. The risk is less about the file format itself and more about the false sense of coverage created when only Office-based blocking is enforced.
Failure mechanism: Attackers exploit the difference between what users are willing to open and what the security stack is configured to scrutinise. Archive nesting, image mounting, and script execution can bypass controls that were designed around macros, leaving the initial payload delivery path under-monitored.
Impact: Successful delivery can lead to loader execution, credential theft, lateral movement, and ultimately ransomware deployment before defenders realise the original attachment was malicious. Where the control gap is systemic, the same pattern can recur across many campaigns even if the malware family changes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204 — User Execution | The attack depends on a user opening a file to start execution. |
| T1027 — Obfuscated Files or Information | Zips and disk images are used to conceal malicious payloads from inspection. | |
| Recommendation — Map attachment launches to T1204 and hunt for user-triggered execution in email and endpoint telemetry. Detect archive and image-based payload concealment under T1027 and inspect nested content. | ||
| CIS Controls v8 | 8 — Audit Log Management | Execution paths and attachment handling need logging to reveal the initial access chain. |
| 10 — Malware Defenses | The subject is about shifting malware delivery to less obvious file types. | |
| 13 — Network Monitoring and Defense | Delivery and detonation often create observable network and beaconing activity. | |
| Recommendation — Enable logging for attachment detonation, file extraction, and child process creation. Apply malware defenses to archives, disk images, and scripts, not only Office files. Correlate email, endpoint, and network telemetry to catch early ransomware staging. | ||
| NIST CSF 2.0 | PR.DS — Data Security | Attachment inspection and containment protect data from malicious payload delivery. |
| DE.CM — Continuous Monitoring | File-type pivots require continuous detection across changing delivery methods. | |
| Recommendation — Strengthen content inspection and containment controls for executable attachments. Monitor for new attachment formats and unexpected execution patterns across the environment. | ||
Practitioner Guidance
Where to start: Review your attachment controls by execution risk, not by file extension family. Prioritise any path that allows script execution, archive unpacking, or image mounting to bypass the same inspection logic that protects Office documents.
Common mistake: Treating macro blocking as a completed email-security programme. That control is useful, but it is only one branch of the delivery tree, and ransomware operators will often choose the next branch that receives less attention.
What good looks like: A user opening an ISO, zip, or script file should trigger the same layered scrutiny as other executable delivery vectors, with clear logging, sandboxing where appropriate, and response playbooks that assume the file type can change while the attacker objective stays the same.
Practitioner takeaway: The attacker’s objective is code execution, so the defender’s objective must be format-agnostic inspection and response, not a policy that only remembers the last delivery method.
Related resources from NHI Mgmt Group
- What happens when identity blind spots let an attacker move from initial access to ransomware deployment?
- What happens when attackers use compromised identity or access paths to move from initial access to deeper compromise?
- How should security teams respond when ransomware operators gain initial access through stolen credentials and then move laterally across endpoints?
- Who should own access decisions when reviews move from users to groups?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
