Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months

Risk actors could have been exploiting one of many zero-day bugs that Microsoft patched in its July safety replace for at the least 18 months previous to patch launch.

Although the vulnerability (CVE-2024-38112) impacts the MSHTML (Trident) engine for the now retired Web Explorer (IE) browser, newer Home windows 10 and Home windows 11 methods — the place Edge is the default browser — are additionally vulnerable to assaults concentrating on the flaw.

Novel Exploit Chain

Haifei Li, a safety researcher at Test Level, found and reported the flaw to Microsoft in Might. In a latest weblog publish, Li described CVE-2024-38112 as permitting an attacker to ship victims specifically crafted Web Shortcut recordsdata (aka URL recordsdata) which, when clicked, would use IE — even when not the default browser — to open an attacker-controlled URL. In assaults that Test Level has noticed, the menace actor mixed the flaw exploit with one other novel IE trick for hiding harmful HTML utility recordsdata (or .hta recordsdata) within the guise of a benign wanting PDF doc.

“To summarize the assaults from the exploitation perspective: The primary method utilized in these campaigns is [a] trick, which permits the attacker to name IE as an alternative of the safer Chrome/Edge,” Li wrote. “The second method is an IE trick to make the sufferer imagine they’re opening a PDF file, whereas actually, they’re downloading and executing a harmful .hta utility.”

In a worst case state of affairs, the vulnerability might enable an attacker to run ransomware, adware, and different arbitrary code on the sufferer’s machine, says Eli Smadja, analysis group supervisor at Test Level.  

Exploited in Focused Infostealer Campaigns?

Smadja says Test Level’s evaluation of assaults concentrating on the flaw are nonetheless ongoing. Nevertheless, an preliminary evaluation has proven at the least two doubtless completely different menace actors are exploiting CVE-2024-38112 in concurrent campaigns, concentrating on people in Vietnam and Turkey. One of many campaigns includes makes an attempt by the attacker to drop the Atlantida info stealer on focused victims within the two international locations.

“This actor exploits compromised WordPress platforms to execute assaults utilizing HTA and PowerShell recordsdata, which ultimately deploy the Atlantida stealer heading in the right direction machines,” Smajda says. “We imagine there could also be extra, undiscovered incidents pushed by cybercriminal motives,” he says.

Rapid7 earlier this yr recognized Atlantida as malware that permits theft of credential info, cryptocurrency pockets knowledge, browser knowledge, display screen info, {hardware} knowledge, and different info from compromised methods.

Microsoft described CVE-2024-38112 as a spoofing vulnerability that would have a excessive influence on system confidentiality, integrity, and availability if efficiently exploited. The corporate nonetheless has assigned it solely a reasonably excessive severity ranking of seven.5 out of 10, based mostly on, amongst different issues, the truth that an attacker would want to persuade a sufferer to work together with the weaponized URL file for any assault to work.

The US Cybersecurity and Infrastructure Safety Company (CISA) has already added CVE-2024-38112 to its catalog of identified exploited vulnerabilities (KEV) and has urged organizations to use Microsoft’s mitigations for the vulnerability. Federal civilian govt department businesses have till July 30 to remediate the problem or discontinue use of affected merchandise till they’ve mounted the problem.

The Trident bug is certainly one of two zero-days from Microsoft’s July replace that CISA has added to its KEV catalog. The opposite is CVE-2024-38080, a privilege escalation flaw in Microsoft Home windows Hyper-V virtualization expertise. Microsoft has mentioned the vulnerability permits an attacker with native entry to accumulate system-level privileges.

In all, Microsoft launched fixes for a complete of 139 vulnerabilities in its merchandise, making the July replace bigger in CVE quantity than the corporate’s updates for Might and June mixed.