Sunday, a SANS Internet Storm Center handler published a YARA rule. No product launch. A signature for orphaned VBA projects living inside DWG files, the AutoCAD drawings your architects treat like oversized PDFs. If your cybersecurity program still files CAD under “documents,” you just got a reminder that executable junk hides in formats your SOC never put on a watchlist. The rule is dull on purpose. Dull detections are how you catch the file your users already trust.

The project had no owner, and that was the point

Orphaned VBA in a DWG is a Visual Basic for Applications project sitting in the file’s OLE storage without a clean, inspectable hook to the drawing you see on screen. You open a floor plan. You get walls, grids, and a title block. You do not get the obvious macro warning you’d expect from a Word document that actually bothers to show a project. That’s the design of the trick. Threat detection stacks that unpack Office containers will skate past a .dwg. Gateways trained on .docm and .xlsm often treat CAD as an inert blob. The file lands on a share. Someone double-clicks it. AutoCAD becomes the interpreter.

CAD has run code for a long time: VBA, AutoLISP, .NET modules, and the old acad.lsp autoload habits that still show up in shops that never killed them. The YARA rule exists because handlers kept finding VBA residue in drawings that did not advertise a project. Your facilities, construction, manufacturing, and AEC users live in these files all day. Vendors send markups. Subs send as-builts. A GC forwards a “final” set at 6 p.m. with a deadline in the subject line. That is an inbound execution channel with a friendly icon and a business owner who will fight you if you slow the open.

You already know how this ends if you skip the boring inventory. A drafter opens a redline. AutoCAD loads the orphaned project. Child processes appear. The incident response ticket says “user opened a drawing,” which is true and useless until you pull the file, the process tree, and whatever the drawing tried to fetch. Office macro hygiene got a decade of budget and training. CAD got a shrug and a plotter.

The cybersecurity market hired past the drawing

CyberSN’s latest U.S. report is the kind of mixed bag your CFO will read as permission to freeze backfills. Job postings across the field fell 26 percent. Demand for AI Security Engineer roles is up hard. You can guess which requisitions survive the freeze, and it is not “person who writes YARA for CAD OLE streams.”

The collision is sitting in plain sight. Sunday’s work from SANS is file-format forensics. Monday’s surviving req is an AI title. Defense in depth decks still open at the firewall. They rarely include a line that says scan the BIM drop for OLE streams. Cyber security leadership that staffs only to the job-board spike will buy threat-protection that scores mail and endpoints, then miss the CAD client that just launched a script host. The resume keyword is easier to defend in a budget meeting than a drawing parser.

A 26 percent drop in postings does not drop the number of DWG files hitting your shares. It drops the number of people who will write the rule, tune the sandbox, and stay in the incident response channel when AutoCAD talks to the internet. Brute-force noise against VPN is a known queue with a dashboard. Hidden VBA in a drawing is quieter, and quiet work is what gets cut first. If you are the person still watching CAD volumes, you are doing the job the market stopped advertising. Keep doing it. The drawings will not wait for the next hiring wave.

Put the CAD client on the same leash as Office

Start this week, on the shares you already have. Disable CAD VBA and unused runtimes wherever the business can live without them. Force trusted paths so projects load only from locations you named. Stop users from launching DWG attachments straight from the mail client; stage them first. Put vendor drawings into a quarantine share that gets scanned before anyone with a CAD license can reach them. Load the ISC YARA into the scanner you already run and point it at those volumes. You will find leftovers. Treat hits as malware until a drafter can prove the project is theirs, expected, and signed.

Watch process telemetry like you mean it. A CAD app should not be a parent of cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. If it is, you have an incident. Pull the drawing, the user session, and the outbound connections before someone closes the ticket as user error. Hash the file. Keep the original. Ask who sent it, through which portal, and whether that vendor has a habit of recycling “standard” templates.

Keep going after the first sweep. Add DWG and DXF to malware detonation the way you already did for Office. Fold CAD intake into the same security hardening standard you use for macro-enabled documents: signed projects only, trusted locations only, no macros from email. Inventory every CAD editor and “viewer” install on the floor. If a viewer can execute, it is not a viewer. Update the playbook so the first question is not only “was it Word?” Review vendor drawing portals with the same skepticism you apply to file-share permissions. Drafters do not need local admin for plugins. Give them a packaged, reviewed add-in path, and revoke the rest.

A firewall will not save you once the code runs as the user who opened the floor plan. It can still shrink the blast. CAD workstations do not need broad outbound to random IPs, and a beacon right after a drawing opens is a hunt. That is defense in depth you can actually operate: identity of the file, behavior of the client, and a network leash that assumes the drawing was hostile. Hire the AI engineer if you must. Keep one person who can still read a file format when the floor plan starts talking.

Sources

• Orphaned VBA Projects Inside DWG Files: YARA Rule
• US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars