Hackers Attacking Windows Users With Internet Explorer Zero-Day Vulnerability
- С сайта: Zero-Day(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Zero-Day(cybersecuritynews.com)
Hackers target legitimate Remote Monitoring and Management (RMM) tools as they provide powerful, trusted access to systems and networks.
This can facilitate the widespread and efficient deployment of malware across an organization’s infrastructure.
Cybersecurity researchers at CheckPoint recently discovered that hackers have been actively attacking Windows users with Internet Explorer zero-day vulnerability.
Trend Micro discovered CVE-2024-38112, an MHTML remote code execution vulnerability exploited by APT group Void Banshee.
Internet Explorer Zero-Day Vulnerability
The attack chain abuses internet shortcuts and Microsoft protocol handlers, including MHTML, to access disabled Internet Explorer and execute malicious code.
This vulnerability is used to deliver the Atlantida stealer, active since January 2024, targeting North America, Europe, and Southeast Asia for information theft and financial gain.
.webp)
Attack chain of the CVE-2024-38112 zero-day campaign (Source – Trend Micro)
Despite Internet Explorer’s (IE) official end of support and disabling, its leftovers persist in modern Windows systems.
Void Banshee exploited CVE-2024-38112, a vulnerability similar to CVE-2021-40444, using specially crafted URL files with MHTML protocol handlers and x-usc directives to access and run HTA files through the disabled IE process.
This method bypasses IE’s discontinuation, exploiting its historically large attack surface. Microsoft patched this vulnerability in July 2024 by unregistering the MHTML handler from IE, reads the report.
Void Banshee exploited CVE-2024-38112 by planting a malicious URL file that had been disguised as a PDF to executive professionals and students.
.webp)
Sample book lure (Source – Trend Micro)
To access disabled Internet Explorer, an HTA file is downloaded, VBScript is executed, and MHTML protocol handlers and x-usc directives are utilized in the attack chain.
This culminates in invoking LoadToBadXml, a .NET Trojan loader, which then injects the Atlantida stealer into RegAsm.exe.
.webp)
Atlantida stealer’s collected data (Source – Trend Micro)
The open-source stealers-based Atlantida’s substantial collection includes gathering extensive confidential data from various applications, browsers, and system locations by compressing it and transmitting it through TCP to the attacker.
The malware packs all collected data into a ZIP file and then tunnels it over TCP port 6655 to the attacker’s C&C server.
Despite Internet Explorer being disabled, attackers exploit its remaining presence to install ransomware and other dangerous software.
Void Banshee is an example of an APT group that uses unpatched services to highlight a major security concern.
Rapid response time combined with complex security solutions is highly recommended for breach resolution and systems safeguarding.
#Cyber_Attack #Cyber_Security_News #Zero-Day #APT #cyber_security #cyber_security_news #Zero-Day_Vulnerability
Оригинальная версия на сайте:
Hackers Attacking Windows Users With Internet Explorer Zero-Day Vulnerability
Author: Tushar Subhra DuttaHackers target legitimate Remote Monitoring and Management (RMM) tools as they provide powerful, trusted access to systems and networks.
This can facilitate the widespread and efficient deployment of malware across an organization’s infrastructure.
Cybersecurity researchers at CheckPoint recently discovered that hackers have been actively attacking Windows users with Internet Explorer zero-day vulnerability.
Trend Micro discovered CVE-2024-38112, an MHTML remote code execution vulnerability exploited by APT group Void Banshee.
Internet Explorer Zero-Day Vulnerability
The attack chain abuses internet shortcuts and Microsoft protocol handlers, including MHTML, to access disabled Internet Explorer and execute malicious code.
This vulnerability is used to deliver the Atlantida stealer, active since January 2024, targeting North America, Europe, and Southeast Asia for information theft and financial gain.
Attack chain of the CVE-2024-38112 zero-day campaign (Source – Trend Micro)Despite Internet Explorer’s (IE) official end of support and disabling, its leftovers persist in modern Windows systems.
Void Banshee exploited CVE-2024-38112, a vulnerability similar to CVE-2021-40444, using specially crafted URL files with MHTML protocol handlers and x-usc directives to access and run HTA files through the disabled IE process.
This method bypasses IE’s discontinuation, exploiting its historically large attack surface. Microsoft patched this vulnerability in July 2024 by unregistering the MHTML handler from IE, reads the report.
Void Banshee exploited CVE-2024-38112 by planting a malicious URL file that had been disguised as a PDF to executive professionals and students.
Sample book lure (Source – Trend Micro)To access disabled Internet Explorer, an HTA file is downloaded, VBScript is executed, and MHTML protocol handlers and x-usc directives are utilized in the attack chain.
This culminates in invoking LoadToBadXml, a .NET Trojan loader, which then injects the Atlantida stealer into RegAsm.exe.
Atlantida stealer’s collected data (Source – Trend Micro)The open-source stealers-based Atlantida’s substantial collection includes gathering extensive confidential data from various applications, browsers, and system locations by compressing it and transmitting it through TCP to the attacker.
The malware packs all collected data into a ZIP file and then tunnels it over TCP port 6655 to the attacker’s C&C server.
Despite Internet Explorer being disabled, attackers exploit its remaining presence to install ransomware and other dangerous software.
Void Banshee is an example of an APT group that uses unpatched services to highlight a major security concern.
Rapid response time combined with complex security solutions is highly recommended for breach resolution and systems safeguarding.
#Cyber_Attack #Cyber_Security_News #Zero-Day #APT #cyber_security #cyber_security_news #Zero-Day_Vulnerability
Оригинальная версия на сайте:
