DocuSign has been made aware of a new malicious document builder named EtterSilent that has been used to impersonate DocuSign to deliver malware to victims. The document builder creates Microsoft Office documents containing malicious macros or attempts to exploit a known Microsoft Office vulnerability (CVE-2017-8570) to download malware onto the victim’s computer. This activity is from malicious third-party sources and is not coming from the DocuSign platform. 

To date, the malicious documents have been observed to deliver many different malware families such as Trickbot, QBot, Bazar, IcedID and Ursnif. These types of maldocs are typically delivered to victims via phishing attacks. For more information on how to spot phishing, please see our Combating Phishing white paper.

The following Indicators of Compromise have been seen associated with this activity:

[RESOLVED Mar 5 10:05 CT] The DocuSign/SpringCM Technology team has resolved the performance degradation issue on the NA21 instance.  The issue began at 3/4/2021 8:32:24 PM UTC and ended at 3/5/2021 3:53:58 PM UTC.  A Root Cause Analysis will be posted here as soon as it's available.  

We apologize for any inconvenience this incident has had on customers.

[UPDATE Mar 5, 2021 09:30 CT] The DocuSign/SpringCM Technology team has isolated the performance degradation issue on the NA21 instance and is currently validating potential resolution paths.

Please check the status of trust.springcm.com frequently for updates regarding this issue.

[POSTED Mar 4, 2021 18:20 CT] The DocuSign/SpringCM Technology team is working to resolve a performance degradation issue on the NA21 instance. During this time, a limited number of customers on the NA21 instance may experience data related to Document Reporting appearing out of date.

Please check the status of trust.springcm.com frequently for updates regarding this issue.