Threat actors exploiting the recently patched Windows Kernel Privilege Escalation Vulnerability (CVE-2018-8611) that allows attackers to run arbitrary code in kernel mode and install program with admin privileges.
The vulnerability is due to the improper file execution operations in the kernel mode. Security researchers from Kaspersky uncovered the zero-day vulnerability and it has been reported to Microsoft on October 29, 2018, and Microsoft patched with December security update.
A number of APT groups use the exploit including FruityArmor, CHAINSHOT, and the newly discovered SandCat.
“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox.”
It leads to gain full remote command execution with the latest browser versions. Kaspersky researchers spotted multiple builds of the exploit for the vulnerability that is compatible with the latest Windows operating system versions.
In order to abuse the vulnerability, the exploit first creates a pipe and create a pair of new objects and number of enlistment objects. The Enlistment object is for the association between the transaction and a resource manager.
Kaspersky Lab detected this zero-day flaw using following 2 technologies.
- Behavioral detection engine and Automatic Exploit Prevention for endpoint products
- Advanced Sandboxing and Anti Malware engine for Kaspersky Anti Targeted Attack Platform (KATA)
Once it succeeds with the initial preparation it moves to the second stage where it creates the multiple numbers of threads and bind to a single CPU core.
The vulnerability will be triggered in the third-stage of the thread, Successful execution of NtRecoverResourceManager will mean that race condition has occurred.
Kaspersky said the campaign actively targeting entities in the Middle East and Africa.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
Related Read
Top 10 Best Ways To Secure Your Computer from Cyber Attacks
Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack
