More Than a Quarter of Threats Never Seen Before
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) | |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) |
Full article349 words · extracted from infosecurity-magazine.com · click to collapse
Over a quarter (29%) of threats spotted in Q4 2020 had never before been detected in-the-wild, giving attackers an advantage over their victims, according to HP Inc.
The tech giant’s latest Quarterly Threat Insights Report was compiled from data gathered from its global customers’ Sure Click virtual machines from October to December 2020.
While these isolated micro-VMs effectively segment malware from the endpoint and let it execute harmlessly, the widespread use of packers and obfuscation techniques would help malicious code bypass traditional detection-based filters, HP claimed.
Some 88% of threats were delivered via email, and it took nearly nine days on average for AV engines to recognize their hash. Fake invoice attachments were the most common lure.
Trojans accounted for 66% of malware in the period, driven by spam campaigns delivering banking malware Dridex.
Malicious executables surged by 12%, with CVE-2017-11882 accounting for nearly three-quarters of detections. Another legacy bug, CVE-2017-0199, accounted for a 12% growth in malware designed to run malicious scripts when a victim opens an Office document.
The two findings are a reminder that, despite the current focus on attacks exploiting zero-day vulnerabilities, many campaigns look to capitalize on the fact that organizations often overlook flaws left unpatched from years ago.
Other trends spotted by HP include email thread-hijacking designed to distribute Emotet in government organizations in Central America, the return of the ZLoader banking Trojan and a new Office malware builder (APOMacroSploit) used to craft delivery themed spam campaigns to distribute BitRAT malware.
“Opportunistic cybercrime does not show any signs of slowing. Low-cost malware-as-a-service kits are an attractive prospect to cyber-criminals and we have seen these continue to proliferate in underground forums. Kits like APOMacroSploit, which emerged in Q4 2020, can be bought for as little as $50 USD,” said Alex Holland, senior malware analyst at HP Inc.
“We have also seen threat actors continue to experiment with malware delivery techniques to improve their chances of establishing footholds into networks. The most effective execution techniques we saw in Q4 2020 involved old technologies like Excel 4.0 macros that often offer little visibility to detection tools.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/more-than-quarter-threats-never/