Buhtrap Hackers Group Using Recently Patched Windows Zero-day Exploit to Attack Government Networks

An Infamous Cyberespionage group known as “Buhtrap” uses a Windows Zero-day exploit for its new campaign to attack businesses and perform targeted attack governmental institutions.

Buhtrap hackers group actively targeting various financial institutions in 2015, since then the group improvising their toolset with new exploits and malware to attack Europe and Asia based countries.

Newly observed targetted attack campaign using an exploit for Windows local privilege escalation(CVE-2019-1132), a vulnerability resides in the win32k.sys component and the vulnerability has been fixed by Microsoft in a recent security update.

An attacker who successfully exploits this vulnerability (CVE-2019-1132) could lead to executing the arbitrary code in kernel mode eventually take control of an affected system.

Buhtrap’s new arsenal contains various hacking tools with updated tactics, techniques and procedures (TTPs) which they are using frequently for various other campaigns.

Researchers pointed out that several of their tools are signed with valid code-signing certificates and abuse a known, legitimate application to side-load their malicious payloads.

Buhtrap Malware Campaign Infection Process

Buhtrap’s conducting its espionage campaign for Past five year and currently observed decoy document related to government operations which are very similar to the State Migration Service of Ukraine website, dmsu.gov.ua. 

Decoy document (Source: ESET)

The Malicious document text asks employees to provide their contact information, especially their email addresses also trick them to click the link on it.

Researchers from ESET quoted that the following document is the first decoy document that recently encountered which is used by the Buhtrap group to target government institutions.

Decoy documents used in campaigns against governmental organizations

According to ESET research, “This document contains a malicious macro that, when enabled, drops an NSIS installer whose task is to prepare the installation of the main backdoor. However, this NSIS installer is very different from the earlier versions used by this group. It is much simpler and is only used to set the persistence and launch two malicious modules embedded within it.”

First Module is a password stealer that harvest passwords from mail clients, browsers and other utilities eventually share it to the Command and control sever control by threat actors.

The second module is an NSIS installer that contains a legitimate application which is being abused and load the main backdoor that employed by Buhtrap.

Final backdoor with encrypted in its body with 2 backdoors, the first one is a type of small ShellCode downloader and the second one is Metasploit’s Meterpreter which is a reverse shell that helps to grant the complete control of the compromised system to the attacker.

“In this case, it is unclear if one or several members of this group decided to change focus and for what reasons, but it is definitely something that we are likely to see more of going forward,” ESET concluded.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

TA505 Hackers Group Modifies Remote Admin Tool as a Weaponized Hacking Tool To Attack Victims in the U.S, APAC, Europe

APT 34 Hackers Group Owned Hacking Tools, Webshell, Malware Code, C2 Servers IP Leaked in Telegram

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

12 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

12 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

15 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

18 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

19 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

19 hours ago