Suspected Iranian hacker looks to steal Gmail, Instagram credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article252 words · extracted from therecord.media · click to collapse
An Iranian threat actor discovered earlier this year is responsible for attacks against U.S. targets designed to hoover up Gmail and Instagram credentials, according to research released Wednesday by security firm SafeBreach. While the actor was originally exposed in September, further analysis by the company found phishing attacks that stretched back to July. Almost half of the phishing campaign’s victims are located in the United States. The research also uncovered the PowerShell code, which researchers dubbed PowerShortShell, that attackers used to pilfer a range of critical data from victims, such as screenshots and Telegram files. PowerShortShell was typically delivered via Office documents sent via email, with lures like pictures of Iranian soldiers and evidence of the 'Corona massacre' performed by Iran's supreme leader. SafeBreach said the documents exploited the CVE-2021-40444 vulnerability to drop the malicious PowerShell code, which then gathered data from the infected computer. Researchers said the actor could be linked to Tehran’s regime “since the Telegram surveillance usage is typical of Iran's threat actors like Infy, Ferocious Kitten and Rampant Kitten,” they said, referring to other Iranian hacking groups that various researchers have unmasked in recent years. Malicious actors with links to Iran have relied on social media for most of their phishing operations for years. One of the most recent instances occurred in July, when Facebook revealed that a group of Iranian hackers targeted U.S. military personnel through a "well-resourced and persistent operation" to trick them into providing sensitive information as part of a broader online espionage campaign.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/suspected-iranian-hacker-looks-to-steal-gmail-instagram-credentials