Friday, March 29, 2024

Buhtrap Hackers Group Using Recently Patched Windows Zero-day Exploit to Attack Government Networks

An Infamous Cyberespionage group known as “Buhtrap” uses a Windows Zero-day exploit for its new campaign to attack businesses and perform targeted attack governmental institutions.

Buhtrap hackers group actively targeting various financial institutions in 2015, since then the group improvising their toolset with new exploits and malware to attack Europe and Asia based countries.

Newly observed targetted attack campaign using an exploit for Windows local privilege escalation(CVE-2019-1132), a vulnerability resides in the win32k.sys component and the vulnerability has been fixed by Microsoft in a recent security update.

An attacker who successfully exploits this vulnerability (CVE-2019-1132) could lead to executing the arbitrary code in kernel mode eventually take control of an affected system.

Buhtrap’s new arsenal contains various hacking tools with updated tactics, techniques and procedures (TTPs) which they are using frequently for various other campaigns.

Researchers pointed out that several of their tools are signed with valid code-signing certificates and abuse a known, legitimate application to side-load their malicious payloads.

Buhtrap Malware Campaign Infection Process

Buhtrap’s conducting its espionage campaign for Past five year and currently observed decoy document related to government operations which are very similar to the State Migration Service of Ukraine website, dmsu.gov.ua. 

Decoy document (Source: ESET)

The Malicious document text asks employees to provide their contact information, especially their email addresses also trick them to click the link on it.

Researchers from ESET quoted that the following document is the first decoy document that recently encountered which is used by the Buhtrap group to target government institutions.

Decoy documents used in campaigns against governmental organizations

According to ESET research, “This document contains a malicious macro that, when enabled, drops an NSIS installer whose task is to prepare the installation of the main backdoor. However, this NSIS installer is very different from the earlier versions used by this group. It is much simpler and is only used to set the persistence and launch two malicious modules embedded within it.”

First Module is a password stealer that harvest passwords from mail clients, browsers and other utilities eventually share it to the Command and control sever control by threat actors.

The second module is an NSIS installer that contains a legitimate application which is being abused and load the main backdoor that employed by Buhtrap.

Final backdoor with encrypted in its body with 2 backdoors, the first one is a type of small ShellCode downloader and the second one is Metasploit’s Meterpreter which is a reverse shell that helps to grant the complete control of the compromised system to the attacker.

“In this case, it is unclear if one or several members of this group decided to change focus and for what reasons, but it is definitely something that we are likely to see more of going forward,” ESET concluded.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

TA505 Hackers Group Modifies Remote Admin Tool as a Weaponized Hacking Tool To Attack Victims in the U.S, APAC, Europe

APT 34 Hackers Group Owned Hacking Tools, Webshell, Malware Code, C2 Servers IP Leaked in Telegram

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles