SideWinder phishing campaign targets maritime facilities in multiple countries
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files CVE-2017-0199 is a remote code execution vulnerability in Microsoft Office and WordPad that stems from improper parsing of specially crafted files. Attackers trigger it by getting a user to open a malicious document, after which attacker-controlled code executes with the privileges of the logged-in user. Anyone running the affected Microsoft Office or WordPad software is exposed, and CISA notes the flaw has been leveraged in ransomware campaigns; no CVSS score is available in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and EPSS assigns a 99.9% probability of exploitation within 30 days (100th percentile), indicating active, ongoing exploitation. Do: Apply Microsoft's security updates for Office and Windows per vendor instructions, as required by CISA's KEV catalog; the flaw was publicly reported as fixed in Microsoft's April 2017 security updates. Until patched, treat unsolicited Office documents and email attachments as high-risk, since exploitation requires a user to open a crafted file. Verify that all Office and WordPad installations across the estate—especially endpoints that handle untrusted documents—have received the update. | 7.8 | 100% | KEV ransomware PoC ×6 |
| masshundreds of millions of Office installations worldwide (exact count unknown) | |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) |
Full article707 words · extracted from securityaffairs.com · click to collapse
The APT group SideWinder launched a new espionage campaign targeting ports and maritime facilities in the Indian Ocean and Mediterranean Sea.
SideWinder (also known as Razor Tiger, Rattlesnake, and T-APT-04) has been active since at least 2012, the group mainly targeted Police, Military, Maritime, and the Naval forces of Central Asian countries. In the 2022 attacks, the threat actors also targeted departments of Foreign Affairs, Scientific and Defence organisations, Aviation, IT industry, and Legal firms.
The threat actor maintains a large C2 infrastructure composed of more than 400 domains and subdomains that were used to host malicious payloads and control them.
The BlackBerry Research and Intelligence Team attributed the campaign to the SideWinder group.
The domains and documents employed in the campaign as part of the first stage of the attack suggest threat actors are targeting of Pakistan, Egypt and Sri Lanka. Subdomains used with the second stage delivery demonstrate that the attackers are also targeting of Bangladesh, Myanmar, Nepal and the Maldives.
In recent campaign, the threat actors used meticulously crafted documents that appear to be legitimate and familiar to the target. The bait documented feature recognizable logos and themes relevant to the victim’s work environment. These documents serve as “visual bait” and often relate to specific infrastructure, such as ports. In one case, attackers users documents falsely associated with the Port of Alexandria and the Port Authority of the Red Sea. The experts identified three different visual decoys with title like “employee termination” and “salary cut.” The attackers use these decoy documents as a diversive tactic while while the malware is being deployed.
“Threat actors hope that by eliciting strong emotions such as fear or anxiety, the target will be compelled to immediately open and read the document. The victim will then be so distracted that they won’t notice strange events on their device such as (for example) system popups or increased fan noise caused by high CPU utilization, which is often an early warning sign of a malware infection in progress.” reads the analysis published by the BlackBerry researchers.
Upon opening the decoy file, it relies on a remote template injection technique (CVE-2017-0199) to gain initial access to the target’s system. This vulnerability impacts Microsoft Office and allowed attackers to use a specially-crafted document embedding an OLE2link object to spread malware.
“While labelled as an Outlook issue, this is actually bug actually stems from an issue within RTF files. According to published reports, the exploit uses an embedded OLE2link object in a specially-crafted document. It should also be noted that these attacks can be thwarted by enabling Office’s Protective View feature. There are updates for both Office and Windows to be applied, and both should be considered necessary for complete protection.” reads the Patch Tuesday analysis by the Zero Day Initiative.
Despite the flaw was addressed by Microsoft in April 2017, attackers are exploiting the vulnerability by targeting large organizations with outdated, fragmented, or antiquated infrastructures. They attempt to target endpoints within these organizations that remained unpatched, thus vulnerable to attack.
The phishing emails include a malicious document which contains a plain text URL linking to a site controlled by the attacker. When the document is opened, it accesses this URL to download the next stage of the malware. Specifically, an RTF file exploits the CVE-2017-11882 vulnerability to execute shellcode, which checks whether the system is a real machine (not a virtual machine) before decrypting the malicious code and runbing JavaScript code that loads additional malicious payloads from a remote server. This method helps evade detection by security teams.
The report includes Indicators of Compromise (IoCs) for this campaign along with a detailed MITRE ATT&CK® Mapping, however the researchers have yet to yet observe any samples of the JavaScript delivered in the last stage of the attack.
“The SideWinder threat actor continues to improve its infrastructure for targeting victims in new regions. The steady evolution of its network infrastructure and delivery payloads suggests that SideWinder will continue its attacks in the foreseeable future.” concludes the report. “However, based on SideWinder’s prior campaigns, we believe that the goal of this campaign is espionage and intelligence gathering.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, phishing)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/166325/breaking-news/sidewinder-phishing-campaign-maritime-facilities.html