Cyber Security News

Windows 0-Day Exploited in Wild with Single Right Click

A newly discovered zero-day vulnerability, CVE-2024-43451, has been actively exploited in the wild, targeting Windows systems across various versions.

This critical vulnerability, uncovered by the ClearSky Cyber Security team in June 2024, has been linked to attacks aimed specifically at Ukrainian organizations.

The exploit allows malicious actors to gain control of a system through seemingly innocuous actions such as a single right-click on a malicious file.

Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)

Vulnerability Overview

The zero-day flaw affects nearly all versions of Windows, including Windows 10, and 11, and some configurations of older versions like Windows 7 and 8.1.

The vulnerability is triggered by interacting with specially crafted URL files disguised as legitimate documents.

  • A single right-click on a malicious file (affects all Windows versions).
  • Deleting the file (Windows 10/11).
  • Dragging the file to another folder (Windows 10/11 and some older versions).

The malicious files, often disguised as academic certificates, were first observed being distributed from a compromised official Ukrainian government website.

The attack typically begins with a phishing email containing a malicious URL file. The email from a compromised Ukrainian government server encourages the recipient to renew their academic certificate.

Once the user interacts with the URL file in any triggering ways, a connection to the attacker’s server is established, allowing for the download of additional malicious payloads, including the SparkRAT malware.

SparkRAT, an open-source remote access trojan (RAT), is used to gain control of the victim’s system. Additionally, the attackers employ persistence techniques to maintain access even after a system reboot.

The Ukrainian Computer Emergency Response Team (CERT-UA) has attributed these attacks to the Russian-linked threat actor UAC-0194.

ClearSky researchers have also identified overlaps with techniques used by other Russian-affiliated groups, suggesting using a common toolkit.

Microsoft addressed this vulnerability with a security patch released on November 12, 2024. Users are urged to update their systems immediately to prevent exploitation of CVE-2024-43451.

Maintaining up-to-date security patches remains critical for safeguarding against these ongoing attacks.

Analyze Unlimited Phishing & Malware with ANY.RUN For Free - 14 Days Free Trial.

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update…

2 hours ago

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…

3 hours ago

20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week

A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s Black…

3 hours ago

“PupkinStealer” – .NET Malware Steals Browser Data and Exfiltrates via Telegram

A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals and…

3 hours ago

Phishing Campaign Uses Blob URLs to Bypass Email Security and Avoid Detection

Cybersecurity researchers at Cofense Intelligence have identified a sophisticated phishing tactic leveraging Blob URIs (Uniform…

3 hours ago

VMware Tools Vulnerability Allows Attackers to Modify Files and Launch Malicious Operations

Broadcom-owned VMware has released security patches addressing a moderate severity insecure file handling vulnerability in…

5 hours ago