Threat actors are delivering the Zyklon Malware exploiting three Office vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) CVE-2017-8759 is a code injection flaw (CWE-94) in Microsoft .NET Framework's handling of SOAP WSDL parsing, in which untrusted content referenced by a document or application is parsed and used during object instantiation, allowing attacker-controlled code to run. An attacker triggers it by delivering a specially crafted document — notably a Microsoft Word file referencing a malicious WSDL URL — and gets code execution when the document is opened and .NET downloads and parses the referenced content. Successful exploitation gives the attacker code execution with the privileges of the current user, sufficient to install malware, steal data, or facilitate further compromise. Any Windows system running .NET Framework versions 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, or 4.7 is affected, which at disclosure covered the vast majority of Windows desktops and servers in use. The flaw was a zero-day exploited in the wild at disclosure (September 2017, used in targeted attacks including BlackOasis), is listed in CISA's Known Exploited Vulnerabilities catalog, and public proof-of-concept exploits are available. Do: Apply Microsoft's security updates addressing this vulnerability to all affected .NET Framework versions on Windows endpoints and servers, per the CISA KEV required action. Prioritize user-facing systems that open documents and are internet-exposed, and verify installed .NET Framework versions before and after remediation. As a compensating control, exercise caution with untrusted documents and block or inspect outbound fetches of WSDL references embedded in Office files. | 7.8 | 89% | KEV PoC ×2 |
| masshundreds of millions of Windows devices (affected .NET Framework versions were enabled by default across broadly deployed Windows client and server releases) |
Full article559 words · extracted from securityaffairs.com · click to collapse
Security experts from FireEye have spotted a new strain of the Zyklon malware that has been delivered by using new vulnerabilities in Microsoft Office.
Researchers at FireEye reported the malware was used in attacks against organizations in the telecommunications, financial, and insurance sectors.
Zyklon has been spotted for the first time in 2016, it is a publicly available malware that could be used for multiple purposes such as espionage campaigns, DDoS attacks or to mine cryptocurrency.
“FireEye researchers recently observed threat actors leveraging relatively new vulnerabilities in Microsoft Office to spread Zyklon HTTP malware.” reads the analysis published by FireEye.
“Zyklon is a publicly available, full-featured backdoor capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal.”
The malware is modular, it can download several plugins to implement different features, it may communicate with C&C server over The Onion Router (Tor) network.
In this last campaign, the malicious code has been delivered via spam emails using as a ZIP archive that contains a specially crafted Word document.
The document exploits one of three vulnerabilities in Microsoft Office to deliver a PowerShell script that downloads the final Zyklon payload from a remote server.
One of the flaws exploited by the attackers is CVE-2017-8759, a flaw that was fixed by Microsoft in September 2017 after it was exploited by threat actors such as the Cobalt group to deliver malware in attacks wild.
A second triggered by the documents used in the campaign spotted by FireEye is CVE-2017-11882, a 17-year-old vulnerability in MS Office that could be exploited by remote attackers to install a malware without user interaction.
The flaw is a memory-corruption issue that affects all versions of Microsoft Office released in the past 17 years, including the latest Microsoft Office 365. The vulnerability could be triggered on all versions of Windows operating system, including the latest Microsoft Windows 10 Creators Update.
The vulnerability affects the MS Office component EQNEDT32.EXE that is responsible for insertion and editing of equations (OLE objects) in documents.
This flaw was used by differed APT groups, including the Cobalt group and Iran-linked hackers.
The attackers also exploited the Dynamic Data Exchange (DDE) feature in Office to deliver the malicious code, the same feature was abused by at least one Russian APT group in cyber espionage campaigns and by the powerful Necurs botnet to deliver ransomware.
Once the malware has successfully exploited one of these flaws, it will download a PowerShell script that injects code and fetches the final payload from a remote server.
FireEye highlighted the fact that attackers are exploiting recently discovered flaws in widely adopted software such as the Office suite to increase the likelihood of infecting the victims’ machines.
“Threat actors incorporating recently discovered vulnerabilities in popular software – Microsoft Office, in this case – only increases the potential for successful infections. These types of threats show why it is very important to ensure that all software is fully updated. Additionally, all industries should be on alert, as it is highly likely that the threat actors will eventually move outside the scope of their current targeting.” concludes FireEye.
Technical details about the threat, including the Indicators of Compromise, are available in the report published by FireEye.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs –Zyklon malware, Office)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/67884/malware/zyklon-malware-hacking.html