Thursday, March 28, 2024

Buhtrap Hackers Group Using Recently Patched Windows Zero-day Exploit to Attack Government Networks

An Infamous Cyberespionage group known as “Buhtrap” uses a Windows Zero-day exploit for its new campaign to attack businesses and perform targeted attack governmental institutions.

Buhtrap hackers group actively targeting various financial institutions in 2015, since then the group improvising their toolset with new exploits and malware to attack Europe and Asia based countries.

Newly observed targetted attack campaign using an exploit for Windows local privilege escalation(CVE-2019-1132), a vulnerability resides in the win32k.sys component and the vulnerability has been fixed by Microsoft in a recent security update.

An attacker who successfully exploits this vulnerability (CVE-2019-1132) could lead to executing the arbitrary code in kernel mode eventually take control of an affected system.

Buhtrap’s new arsenal contains various hacking tools with updated tactics, techniques and procedures (TTPs) which they are using frequently for various other campaigns.

Researchers pointed out that several of their tools are signed with valid code-signing certificates and abuse a known, legitimate application to side-load their malicious payloads.

Buhtrap Malware Campaign Infection Process

Buhtrap’s conducting its espionage campaign for Past five year and currently observed decoy document related to government operations which are very similar to the State Migration Service of Ukraine website, dmsu.gov.ua. 

Decoy document (Source: ESET)

The Malicious document text asks employees to provide their contact information, especially their email addresses also trick them to click the link on it.

Researchers from ESET quoted that the following document is the first decoy document that recently encountered which is used by the Buhtrap group to target government institutions.

Decoy documents used in campaigns against governmental organizations

According to ESET research, “This document contains a malicious macro that, when enabled, drops an NSIS installer whose task is to prepare the installation of the main backdoor. However, this NSIS installer is very different from the earlier versions used by this group. It is much simpler and is only used to set the persistence and launch two malicious modules embedded within it.”

First Module is a password stealer that harvest passwords from mail clients, browsers and other utilities eventually share it to the Command and control sever control by threat actors.

The second module is an NSIS installer that contains a legitimate application which is being abused and load the main backdoor that employed by Buhtrap.

Final backdoor with encrypted in its body with 2 backdoors, the first one is a type of small ShellCode downloader and the second one is Metasploit’s Meterpreter which is a reverse shell that helps to grant the complete control of the compromised system to the attacker.

“In this case, it is unclear if one or several members of this group decided to change focus and for what reasons, but it is definitely something that we are likely to see more of going forward,” ESET concluded.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

TA505 Hackers Group Modifies Remote Admin Tool as a Weaponized Hacking Tool To Attack Victims in the U.S, APAC, Europe

APT 34 Hackers Group Owned Hacking Tools, Webshell, Malware Code, C2 Servers IP Leaked in Telegram

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles