New Woody RAT used in attacks aimed at Russian entities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28. Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly. | 7.8 | 99% | KEV ransomware PoC |
| mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base) |
Full article429 words · extracted from securityaffairs.com · click to collapse
An unknown threat actor is targeting Russian organizations with a new remote access trojan called Woody RAT.
Malwarebytes researchers observed an unknown threat actor targeting Russian organizations with a new remote access trojan called Woody RAT. The attackers were delivering the malware using archive files and Microsoft Office documents exploiting the Follina Windows flaw (CVE-2022-30190).
The assumption that attackers focus on Russian entities is based on a fake domain they registered, Malwarebytes is aware that they tried to target a Russian aerospace and defense entity known as OAK.
“The earliest versions of this Rat was typically archived into a zip file pretending to be a document specific to a Russian group. When the Follina vulnerability became known to the world, the threat actor switched to it to distribute the payload, as identified by @MalwareHunterTeam.” states the report published by Malwarebytes.
In the attacks leveraging the archive files (anketa_brozhik.doc.zip, which contains Woody Rat executable, and Anketa_Brozhik.doc.exe, zayavka.zip containing Woody Rat masqueraded as application participation in the selection.doc.exe), the archives are sent to victims via spear-phishing emails.
Attacks exploiting the Windows Follina flaw were spotted on June 7, 2022, when researchers observed threat actors using a weaponized Microsoft Office document titled Памятка.docx. The lure document, called “Information security memo,” provides security practices for passwords, confidential information, etc.
To evade network-based monitoring, the Woody RAT malware uses a combination of RSA-4096 and AES-CBC to encrypt the data sent to the command and control server.
The RAT is equipped with multiple backdoor capabilities, such as writing arbitrary files to the machine, executing additional malware, capturing screenshots, enumerating directories, deleting files, and gathering a list of running processes.
The analysis of the malicious code revealed that the malware has 2 .NET DLLs embedded inside named named WoodySharpExecutor and WoodyPowerSession respectively. WoodySharpExecutor allows the malware to run .NET code received from the C2, while WoodyPowerSession allows the malware to execute PowerShell commands and scripts received from the C2.
Once created the command threads, the malware deletes itself from the disk using the ProcessHollowing technique.
“This very capable Rat falls into the category of unknown threat actors we track. Historically, Chinese APTs such as Tonto team as well as North Korea with Konni have targeted Russia. However, based on what we were able to collect, there weren’t any solid indicators to attribute this campaign to a specific threat actor.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Woody RAT)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/134014/intelligence/woody-rat-targets-russia-orgs.html