Kaspersky: Malware shared by USCYBERCOM first seen in Dec 2016
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11774 | Security Feature Bypass in Microsoft Outlook Allows Arbitrary Command Execution CVE-2017-11774 is a security feature bypass in Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and 2013 RT SP1, and Outlook 2016, caused by the way Outlook handles objects in memory, allowing an attacker to execute arbitrary commands. Triggering the flaw requires user interaction on a local system: public research by SensePost (the referenced PoC) showed a specially crafted email can set a mail folder's home page so that attacker-chosen content loads without a security prompt when the user views the folder. A successful attacker gains code execution in the context of the logged-in user, providing a foothold for credential theft or follow-on activity on the workstation. Any organization still running the affected Outlook editions — typically corporate users on Exchange — is exposed, though these are older editions that many organizations have since migrated away from. The flaw is exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, and the related headlines show US Cyber Command warning that Iran-linked actors were exploiting this CVE alongside other flaws using tools stolen from FireEye, with EPSS putting 30-day exploitation probability at roughly 60% (99th percentile). Do: Apply Microsoft's security updates (released with the October 2017 Patch Tuesday or later) for Outlook 2010 SP2, 2013 SP1/2013 RT SP1, and 2016, as required by CISA's KEV listing. Because Outlook 2010 and 2013 are past mainstream support, organizations still running them should upgrade to a supported Outlook release. Defenders should also hunt for exploitation using the indicators US Cyber Command shared with its warning about Iran-linked activity, and check whether user mail folders have had home pages set by untrusted mail. | 7.8 | 60% | KEV PoC |
| masstens of millions of users (Outlook was the dominant enterprise mail client at the 2017 disclosure, and affected editions were still common when KEV-listed in… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | atlantic.net | reuse of servers hosted by the service providers Choopa and Atlantic.net.” [adrotate banner=”9″] [adrotate banner=”12″] Pierluigi Pa |
| md5 | 9b1a06590b091d300781d8fbee180e75 | wo of the files (MD5: d87663ce6a9fc0e8bc8180937b3566b9, MD5:9b1a06590b091d300781d8fbee180e75) were first seen in 2016. “USCYBERCOM’s VirusTotal executab |
| md5 | d87663ce6a9fc0e8bc8180937b3566b9 | ng the CVE-2017-11774 vulnerability, two of the files (MD5: d87663ce6a9fc0e8bc8180937b3566b9, MD5:9b1a06590b091d300781d8fbee180e75) were first seen in 2 |
| url | https://customermgmt.net/page/macrocosm | immediate #patching . Malware is currently delivered from: 'hxxps://customermgmt.net/page/macrocosm' #cybersecurity #infosec — USCYBERCOM Cybersecurity Alert ( |
Full article543 words · extracted from securityaffairs.com · click to collapse
The malware samples shared by USCYBERCOM last week were first detected in December 2016 in attacks attributed to Iran-linked APT33.
Last week the United States Cyber Command (USCYBERCOM) uploaded to VirusTotal a malware used by Iran-linked APT33 group in attacks in Dec 2016 and Jan 2017.
USCYBERCOM has discovered active malicious use of CVE-2017-11774 and recommends immediate #patching. Malware is currently delivered from: 'hxxps://customermgmt.net/page/macrocosm' #cybersecurity #infosec
— USCYBERCOM Cybersecurity Alert (@CNMF_CyberAlert) July 2, 2019
Now experts at Kaspersky confirmed that the malware was used in attacks exploiting the CVE-2017-11774 vulnerability, two of the files (MD5: d87663ce6a9fc0e8bc8180937b3566b9, MD5:9b1a06590b091d300781d8fbee180e75) were first seen in 2016.
“USCYBERCOM’s VirusTotal executable object uploads appeared in our January 2017 private report “NewsBeef Delivers Christmas Presence”, an examination of a change in the tactics used in spear-phishing and watering hole attacks against Saudi Arabian targets.” reads a report published by Kaspersky. “Two files uploaded by USCYBERCOM are of particular interest. These were first seen Dec 2016 and Jan 2017: “
At the time, the security firm warned in a private report its customers of the threats. In particular, the researchers attributed the attacks at the NewsBeef threat actor (aka Charming Kitten, Newscaster, Ajax Security Team, and APT35).
The private report issued by Kaspersky in January 2017, titled ” “NewsBeef Delivers Christmas Presence,” analyzed the evolution of TTPs of the NewsBeef group. Experts noticed that the threat actors added new tools to its arsenal, including macro-enabled Office documents, PowerSploit, and the Pupy backdoor.
Pupy is an open source, multi-platform (Windows, Linux, OSX, Android), multi-function backdoor. The backdoor is mainly written in Python and borrows code from other open source attack tools, including PowerSploit, Mimikatz, laZagne, etc.
“Pupy can generate backconnect or bindport payloads in multiple formats: PE executables (x86/x64) for Windows, ELF binary/.so for Linux, reflective DLLs (x86/x64), pure Python files, PowerShell, apk, and Rubber Ducky script (Windows).” reads the report.
Attackers also carried out spear-phishing campaigns and watering hole attacks, primarily aimed at targets in Saudi Arabia (Government financial and administrative organizations, Government health organizations, Engineering and technical organizations, one British labor-related government organization (targeted multiple times)).
The NewsBeef threat actors were continuing to deploy malicious macro-enabled Office documents, poisoned legitimate Flash and Chrome installers, PowerSploit, and Pupy tools
Experts discovered that the compromised websites infected with an obfuscated JavaScript used to redirect visitors to NewsBeef-controlled hosts that tracked victims and served malware.
The Kaspersky report and the USCYBERCOM uploads confirm that Iran-linked APT groups use to share malware code, the malware has been associated with the COBALT GYPSY threat group, and also associated with the Shamoon.
“Previous reports on the NewsBeef APT noted the group’s reliance on open-source tools to launch simple, yet effective attacks. Historically, the group has used BeEF to track targets and deliver malicious payloads.” concludes the report. “However, as this recent campaign indicates, the NewsBeef APT appears to have shifted its intrusion toolset away from BeEF and towards macro-enabled malicious Office documents, PowerSploit, and Pupy. Despite this shift in toolset, the group still relies on old infrastructure as evidenced by their reuse of servers hosted by the service providers Choopa and Atlantic.net.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – USCYBERCOM, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/88130/malware/malware-shared-uscybercom-dated-2016.html