LimeRAT malware delivered using 8-year
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days. Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching. | — | 100% | KEV ransomware |
| masshundreds of millions of Windows systems potentially affected |
Full article447 words · extracted from securityaffairs.com · click to collapse
Researchers spotted a campaign using Excel files to spread LimeRAT malware using the 8-year-old and well-known VelvetSweatshop bug.
Researchers at the Mimecast Threat Center spotted a new campaign using Excel files to spread LimeRAT malware using the 8-year-old VelvetSweatshop bug.
LimeRAT is a powerful Remote Administration Tool publicly available as an open-source project on Github, it could be used by attackers to take over an infected system and install other malicious payloads.
Attackers behind this campaign are creating read-only Excel files that embed the LimeRAT payload, then send them to the potential victims.
In malspam attacks, attackers could encrypt the Excel file by setting up a password, then when the victims receive the email, hackers trick them into opening the attachment using a password included in the content of the message.
The process could be automated using the default VelvetSweatshop password used by Excel to protect the files that have been sent in read-only mode.
The presence of the ‘VelvetSweatshop’ hardcoded password is known since 2012 and it is tracked as CVE-2012-0158.
To decrypt an encrypted file in read-only mode, Excel first attempts to use the embedded, default password, “VelvetSweatshop.” Excel attempts to decrypt and open the file and run any macros it contains. Microsoft Office system will not generate a warning dialog to notify the user that the file is read-only.
If it fails to decrypt the file using the “VelvestSweatshop” password, Excel will request that the user provide a password.
Summarizing, using an Excel file read-only the attackers don’t need any action from the victims, then just need to double-click the file without providing any password.
“Recently, Mimecast threat intelligence researchers came across a campaign which used this Excel VelvetSweatshop encryption technique to deliver LimeRAT, a malicious remote access trojan.” reads the analysis published by the experts.
“In this specific attack, the cybercriminals also used a blend of other techniques in an attempt to fool anti-malware systems by encrypting the content of the spreadsheet hence hiding the exploit and payload.”
Mimecast experts also pointed out that threat actors behind this campaign used other techniques in an attempt to evade detection, such as encrypting the content of the spreadsheet hence hiding the exploit and payload.
Researchers believe that other threat actors could use the VelvetSweatshop technique to deliver weaponized Excel files that attempt to infect the victims with verious malware.
Mimecast recommended close scrutiny of any email with files attached, the use of an email security system with advanced malware protection capabilities, monitoring network traffic for outbound connections to likely command-and-control (C2) services, and continuously updating endpoint security systems.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – LimeRAT, malware)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/100856/breaking-news/limerat-velvetsweatshop-technique.html