Wednesday, April 24, 2024

APT Hackers Group Exploiting the Window OS Using New Zero day Vulnerability

Cyber criminals started exploiting the Microsoft windows os using recently discovered win32k zero day vulnerability that was patched by Microsoft recently.

A zero-day vulnerability that resides in the win32k.sys allows attackers to exploit 64-bit operating systems in the range from Windows 8 to Windows 10.

This vulnerability ( CVE-2019-0797) was initially discovered by the kaspersky lab researchers who was reported to Microsoft and the fixed patch was released on March 2019 security update.

A Privilege escalation vulnerability that exists in Windows OS when the Win32k component fails to properly handle objects in memory let allow attackers to run arbitrary code in kernel mode.

This new Exploit is currently used by several ATP threat actors in wide including FruityArmor and SandCat, both are recently active APT groups that specifically targeting the victims using zero day exploits.

According to Costin Raiu, director of global research, Kaspersky Lab, “SandCat is a relatively new APT group; we first observed them in 2018, although it would appear they have been around for some time,” ,

Kaspersky researcher discovered this new windows exploit using 2 different technologies

  1. Behavioral detection engine and Automatic Exploit Prevention for endpoint products;
  2. Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA)

New Zero day vulnerability (CVE-2019-0797)

This vulnerability resides in the win32k driver due to improper synchronization between undocumented two syscalls,


Kaspersky researchers explained that, “The problem lies in the fact that when the syscalls NtDCompositionDiscardFrame and NtDCompositionDestroyConnection are executed simultaneously, the function DiscardAllCompositionFrames may be executed at a time when the NtDCompositionDiscardFrame syscall is already looking for a frame to release or has already found it. This condition leads to a use-after-free scenario.”

Researcher observed that the attackers made a few attacks by exploiting this zero day vulnerability and all the windows users need to apply the necessary patch to prevent from this attack.

Attackers are using the exploitation process in same way for all the vulnerable OS versions using heap spraying palettes to leak their kernel addresses. 

Besides that, the exploit performs a check on whether it’s running from Google Chrome and stops execution if it is because vulnerability CVE-2019-0797 can’t be exploited within a sandbox. kaspersky said.

All the windows users urged to update your operating system let Microsoft apply the patches for this vulnerability on your windows system.

Also Learn: Certified Advanced Persistent Threat Analyst online course

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...

Rewards Up to $10 Million for Information on Iranian Hackers

The United States Justice Department has announced big rewards for information leading to the...

PoC Exploit Released For Critical Oracle VirtualBox Vulnerability

Oracle Virtualbox was identified and reported as having a critical vulnerability associated with Privilege...

Tracing the Steps of Cyber Intruders: The Path of Lateral Movement

When cyber attacks strike, it's rarely a single computer that suffers. Nowadays, cybercriminals set...

U.S. to Impose Visa Restrictions on 13 Individuals Involved in Commercial Spyware Operations

To combat the misuse of commercial spyware, the United States Department of State has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles