Threat actors exploiting the recently patched Windows Kernel Privilege Escalation Vulnerability (CVE-2018-8611) that allows attackers to run arbitrary code in kernel mode and install program with admin privileges.
The vulnerability is due to the improper file execution operations in the kernel mode. Security researchers from Kaspersky uncovered the zero-day vulnerability and it has been reported to Microsoft on October 29, 2018, and Microsoft patched with December security update.
A number of APT groups use the exploit including FruityArmor, CHAINSHOT, and the newly discovered SandCat.
“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox.”
It leads to gain full remote command execution with the latest browser versions. Kaspersky researchers spotted multiple builds of the exploit for the vulnerability that is compatible with the latest Windows operating system versions.
In order to abuse the vulnerability, the exploit first creates a pipe and create a pair of new objects and number of enlistment objects. The Enlistment object is for the association between the transaction and a resource manager.
Kaspersky Lab detected this zero-day flaw using following 2 technologies.
Once it succeeds with the initial preparation it moves to the second stage where it creates the multiple numbers of threads and bind to a single CPU core.
The vulnerability will be triggered in the third-stage of the thread, Successful execution of NtRecoverResourceManager will mean that race condition has occurred.
Kaspersky said the campaign actively targeting entities in the Middle East and Africa.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
Top 10 Best Ways To Secure Your Computer from Cyber Attacks
Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…