Tuesday, July 16, 2024
EHA

APT Hackers Group Exploiting the Window OS Using New Zero day Vulnerability

Cyber criminals started exploiting the Microsoft windows os using recently discovered win32k zero day vulnerability that was patched by Microsoft recently.

A zero-day vulnerability that resides in the win32k.sys allows attackers to exploit 64-bit operating systems in the range from Windows 8 to Windows 10.

This vulnerability ( CVE-2019-0797) was initially discovered by the kaspersky lab researchers who was reported to Microsoft and the fixed patch was released on March 2019 security update.

A Privilege escalation vulnerability that exists in Windows OS when the Win32k component fails to properly handle objects in memory let allow attackers to run arbitrary code in kernel mode.

This new Exploit is currently used by several ATP threat actors in wide including FruityArmor and SandCat, both are recently active APT groups that specifically targeting the victims using zero day exploits.

According to Costin Raiu, director of global research, Kaspersky Lab, “SandCat is a relatively new APT group; we first observed them in 2018, although it would appear they have been around for some time,” ,

Kaspersky researcher discovered this new windows exploit using 2 different technologies

  1. Behavioral detection engine and Automatic Exploit Prevention for endpoint products;
  2. Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA)

New Zero day vulnerability (CVE-2019-0797)

This vulnerability resides in the win32k driver due to improper synchronization between undocumented two syscalls,

1.NtDCompositionDiscardFrame
2.NtDCompositionDestroyConnection

Kaspersky researchers explained that, “The problem lies in the fact that when the syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection are executed simultaneously, the function DiscardAllCompositionFrames may be executed at a time when the NtDCompositionDiscardFrame syscall is already looking for a frame to release or has already found it. This condition leads to a use-after-free scenario.”

Researcher observed that the attackers made a few attacks by exploiting this zero day vulnerability and all the windows users need to apply the necessary patch to prevent from this attack.

Attackers are using the exploitation process in same way for all the vulnerable OS versions using heap spraying palettes to leak their kernel addresses. 

Besides that, the exploit performs a check on whether it’s running from Google Chrome and stops execution if it is because vulnerability CVE-2019-0797 can’t be exploited within a sandbox. kaspersky said.

All the windows users urged to update your operating system let Microsoft apply the patches for this vulnerability on your windows system.

Also Learn: Certified Advanced Persistent Threat Analyst online course

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Website

Latest articles

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles