Saturday, November 2, 2024
HomeGoogleGoogle Chrome 0-Day Vulnerability Exploited in The Wild To Deploy Spyware

Google Chrome 0-Day Vulnerability Exploited in The Wild To Deploy Spyware

Published on

Malware protection

This month came to light a zero-day vulnerability that has long been exploited by evildoers inside Google Chrome, but that has now been patched by the company. This flaw has been weaponized by an Israeli spy company and used in attacks against Middle Eastern journalists and their families.

In response to the exploitation, cybersecurity firm Avast connected the incident to Candiru (also known as Saito Tech). A Windows malware dubbed DevilsTongue has been deployed by this group on a number of occasions prior to now by exploiting previously unknown flaws.

Essentially, it is a zero-day vulnerability, with the CVE-2022-2294 designation, which has been identified in Google Chrome. As it turns out, it is memory corruption in WebRTC that was exploited in Chrome’s renderer process to be executed shellcode in a way that was not intended.

- Advertisement - SIEM as a Service

Explotaion & Targets

During the months following the July 2021 discovery of the malware by Microsoft and CitizenLab, Candiru kept a low profile for several months. 

It is likely that it took its time updating its malware in order to avoid detection by the existing detection system, that’s why it took so long.

This time it return with an updated toolset in March 2022, targeting users located in the following countries:-

  • Lebanon
  • Turkey
  • Yemen
  • Palestine

Attackers are exploiting zero-day vulnerabilities in Google Chrome to launch watering hole attacks on users. The attacks were thought to be highly targeted, but it’s not yet clear whether this is true.

It appears that the attackers in Lebanon have compromised a website that is used by news agency employees in order to carry out their duties. 

An artifact of persistent, XSS attacks was found on the compromised website, such as pages that contained the following information:-

An alert function was called with the keyword ‘test’ accompanied by a call to the Javascript function alert.

Data Collected

It is at this point that Candiru gathers more information about the victim as soon as it arrives at the exploit server. Attackers collect about 50 data points about the victim’s browser and send that information to them in the form of a profile of the victim’s computer. 

A number of information about the victim has been collected, including the:- 

  • Language
  • Timezone
  • Screen information
  • Device type
  • Browser plugins
  • Referrer
  • Device memory
  • Cookie functionality

As a result of this, it’s ensured that the exploit would be further protected and that only the targeted victims would receive it. The exploit server sends an encryption key to the victim via RSA-2048 if the data collected in the exploit has satisfied its requirements.

Using this encryption key along with the AES-256-CBC algorithm, it is possible to deliver zero-day exploits to the victim. In order to be able to deliver the exploit, an encrypted route must first be established so that it can be delivered anonymously.

Additionally, in recent years, it has been reported that since early 2021, state-sponsored hacking groups have been actively targeting journalists to spread malware and conduct espionage.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to...

New AI Tool To Discover 0-Days At Large Scale With A Click Of A Button

Vulnhuntr, a static code analyzer using large language models (LLMs), discovered over a dozen...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...