Researchers from the Google Threat Analysis group uncovered an incident associated with the north Korean APT37 hackers group that they have exploited an Internet Explorer Zero-day vulnerability.
Threat actors attempted to exploit the vulnerability using a weaponized document that was used to target the victims from South Korea also this APT37 believed to be a state-sponsored hacker group operating under the North Korean government.
An Internet Explorer zero-day vulnerability (CVE-2022-41128) resides in the JScript engine and allows attackers to exploit the vulnerability by executing arbitrary code. Upon successful attempts, let actors take complete control of the browser while the user loads the malicious website controlled by the attackers.
“An Internet Explorer zero-day vulnerability that existing in the JScript engine that allowed attackers to exploit the vulnerability by executing the arbitrary code and take the complete control of browser when user load the malicious website that controlled by the attackers.” Google Threat Analysis Group reported.
A multiple submission of malicious Microsoft office documents were being uploaded from South Korea in Virus total engine ” “221031 Seoul Yongsan Itaewon accident response situation (06:00).docx” that refers to the recent South Korean large Halloween incident that cause several life’s.
Upon the successfully click on the document download a rich text file (RTF) remote template trigger to fetched remote HTML content that gets render only via IE and the technique is widely used by the several hacking attempts by various hackers group.
“Delivering IE exploits via this vector has the advantage of not requiring the target to use Internet Explorer as its default browser, nor to chain the exploit with an EPM sandbox escape.”
The malicious document has applied with the MotW (Mark-of-the-Web), a Windows feature designed to protect users against files from untrusted sources. Actors trick users disable the protected view before the remote RTF template gets fetched.
“When delivering the remote RTF, the web server sets a unique cookie in the response, which is sent again when the remote HTML content is requested. This likely detects direct HTML exploit code fetches which are not part of a real infection.”
Also, the Javascript exploit has checked that the cookie was set before launching the exploit and reporting to the command & control server twice while dropping the exploit and after the successful execution.
The Windows API has resolved by Shell code with the custom hash algorithm, and the interesting part is that the Shellcode Wiped all the exploitation traces in the browser and clear the caches before moving ahead to download the next stage.
As part of this same campaign, attackers launched several malicious documents that attempt to exploit the same vulnerability.
Unfortunately, Researchers didn’t recover the final payload and observed that this has connection with various implants such as implants like ROKRAT, BLUELIGHT, and DOLPHIN.
Initial documents:
Remote RTF template:
Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…