Qbot - known channel for ransomware - delivered via phishing and Follina exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28. Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly. | 7.8 | 99% | KEV ransomware PoC |
| mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base) |
Full article502 words · extracted from helpnetsecurity.com · click to collapse
More than a week has passed since Microsoft acknowledged the existence of the “Follina” vulnerability (CVE-2022-30190), after reports of it being exploited in the wild began to crop up here and there. Since then, other state-backed threat actors have started exploiting it, but now one of the most active Qbot (QakBot) malware affiliates has also been spotted leveraging Follina.
Archive contains an IMG with a Word doc, shortcut file, and DLL. The LNK will execute the DLL to start Qbot. The doc will load and execute a HTML file containing PowerShell abusing CVE-2022-30190 used to download and execute Qbot.
— Threat Insight (@threatinsight) June 7, 2022
#Follina #Qbot storm – Detect at the earliest!
Malspam -> HTML-> ZIP -> IMG -> ( LNK+DLL+Follina )
Look for stolen chain email attachments which are HTML and
Size between 933000 and 935000 bytes.
Match following filename pattern
[0-9]{8}\_[0-9]{6}.htmlhttps://t.co/xaKa60O3hW pic.twitter.com/L2MQ8vMfyQ— Ankit Anubhav (@ankit_anubhav) June 8, 2022
Follina exploitation leads to Qbot installation
Setting aside for a moment the fact that Qbot is an effective information stealer and backdoor in its own right, this latest development should worry most organizations, as a variety of Ransomware-as-a-Service (RaaS) operators use Qbot to secure a foothold into corporate networks before deploying ransomware.
These most recent campaigns begin with email thread hijacking – a regular trick employed by Qbot affiliates – and the delivery of an HTML attachment.
Once opened, the file drops an archive (.zip), which contains a disk image file (.img) with inside a Word document, a shortcut file (.lnk), and a .dll file.
“The LNK will execute the DLL to start Qbot. The doc will [retrieve from a remote server and] load and execute a HTML file containing PowerShell abusing CVE-2022-30190 used to download and execute Qbot,” Proofpoint threat researchers explained. With this double whammy they’re leaving nothing to chance, hoping that at least one of these approaches will be successful.
In another variant of the attack, instead of the .img file in the zipped archive is an .iso file (another type of disk image file), which again contains a .docx file (Word document), a .lnk and a .dll file. For that variant, a malware hunter that goes by the online nick “ExecuteMalware” has compiled a list of indicators of compromise.
Threat detection and risk mitigation
Given that Microsoft has yet to release a fix for Follina, enterprise defenders are left with performing risk mitigation actions such as implementing temporary workarounds.
Microsoft has updated their guidance for CVE-2022-30190 mitigation and pointed out effective and non-effective workarounds. Security researcher Benjamin Delpy has previously shared another mitigation that has been confirmed to work.
There’s also the option of implementing a free micropatch created by ACROS Security.(As a sidenote: they’ve also developed micropatches for a less critical, but still serious path traversal vulnerability affecting Microsoft’s Diagnostic Tool that Microsoft doesn’t intend to fix.)
UPDATE (June 9, 2022, 04:35 a.m. ET):
Some attackers are abusing Follina to deliver the AsyncRAT and an infostealer.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/06/08/qbot-follina-exploit/