Saturday, December 2, 2023

Hackers Actively Exploiting the Recently Patched Windows kernel Zero-day Vulnerability in Wild

Threat actors exploiting the recently patched Windows Kernel Privilege Escalation Vulnerability (CVE-2018-8611) that allows attackers to run arbitrary code in kernel mode and install program with admin privileges.

The vulnerability is due to the improper file execution operations in the kernel mode. Security researchers from Kaspersky uncovered the zero-day vulnerability and it has been reported to Microsoft on October 29, 2018, and Microsoft patched with December security update.

A number of APT groups use the exploit including FruityArmor, CHAINSHOT, and the newly discovered SandCat.

“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox.”

It leads to gain full remote command execution with the latest browser versions. Kaspersky researchers spotted multiple builds of the exploit for the vulnerability that is compatible with the latest Windows operating system versions.

In order to abuse the vulnerability, the exploit first creates a pipe and create a pair of new objects and number of enlistment objects. The Enlistment object is for the association between the transaction and a resource manager.

Image: Kaspersky

Kaspersky Lab detected this zero-day flaw using following 2 technologies.

  1. Behavioral detection engine and Automatic Exploit Prevention for endpoint products
  2. Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA)

Once it succeeds with the initial preparation it moves to the second stage where it creates the multiple numbers of threads and bind to a single CPU core.

The vulnerability will be triggered in the third-stage of the thread, Successful execution of NtRecoverResourceManager will mean that race condition has occurred.

Kaspersky said the campaign actively targeting entities in the Middle East and Africa.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Top 10 Best Ways To Secure Your Computer from Cyber Attacks

Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles