North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE JetBrains TeamCity Server, a widely used CI/CD build server, contains an authentication bypass vulnerability (CWE-288) that lets a remote, unauthenticated attacker gain administrative access without valid credentials. By sending crafted requests to the TeamCity server over the network, the attacker bypasses authentication and can then execute arbitrary code on the server via administrative and build features, achieving full remote code execution. An attacker gains control of the build server and, with it, access to source code, build artifacts, stored secrets and credentials, and a foothold for lateral movement or ransomware deployment. Any organization running an affected TeamCity Server is affected, especially instances reachable from the internet. Exploitation is confirmed in the wild: CISA added the flaw to its KEV catalog on 2023-10-04 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Upgrade TeamCity Server to 2023.05.4 or later per JetBrains' instructions, or apply vendor mitigations or discontinue use if patching is not possible (per the CISA KEV required action). Also take unpatched instances off the public internet, and hunt for signs of compromise such as unauthorized administrator accounts, unexpected changes in audit logs and build configurations, and stored secrets or tokens that may have been stolen, given known ransomware exploitation. | 9.8 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of TeamCity Server deployments, of which several thousand are internet-exposed | |
| CVE-2024-21338 | Local Privilege Escalation in Microsoft Windows Kernel via Exposed IOCTL (CVE-2024-21338) CVE-2024-21338 is a local privilege escalation flaw in the Microsoft Windows kernel caused by an exposed IOCTL with insufficient access control (CWE-822): a low-privileged process running locally can issue specially crafted requests to a kernel interface without proper authorization checks. Public research (including Avast's analysis of Lazarus Group's FudModule rootkit) ties the vulnerable component to the Windows AppLocker/AppID driver and shows the bug was exploited as an admin-to-kernel zero-day, letting an attacker with a foothold on a machine gain kernel-level privileges and full control of the host. Because it requires only local access, it is typically chained after initial access or malware delivery, and CISA notes known ransomware use alongside exploitation by North Korea's Lazarus Group. Any organization or device running Windows 10 (1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2019/2022 (including 2022 23H2) is affected until patched. The bug was added to the CISA Known Exploited Vulnerabilities catalog on 2024-03-04 after in-the-wild exploitation and was fixed in Microsoft's March 2024 Patch Tuesday release; EPSS places the 30-day exploitation probability at roughly 60% (99th percentile). Do: Apply Microsoft's March 2024 (or later) cumulative security updates to every listed Windows 10, Windows 11, and Windows Server 2019/2022 system, and verify the installed build includes the March 2024 fixes before closing the KEV entry; if patches are unavailable, follow CISA's required action to apply vendor mitigations or discontinue use. Because this is a local-only escalation commonly chained after initial access, prioritize workstations and servers where untrusted users or code run locally. Hunt for Lazarus/FudModule and BYOVD-related indicators per Avast's published research on hosts of interest. | 7.8 | 60% | KEV ransomware PoC ×3 |
| masson the order of 1 billion devices (essentially the entire supported Windows 10/11 and Windows Server 2019/2022 installed base) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | henraux.com | download shellcode from a command-and-control (C2) domain ("henraux[.]com"), which is suspected to be an actual-but-hacked website |
Full article676 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 25, 2024Malware / Cyber Threat
The North Korea-linked threat actor known as Lazarus Group employed its time-tested fabricated job lures to deliver a new remote access trojan called Kaolin RAT as part of attacks targeting specific individuals in the Asia region in summer 2023.
The malware could, "aside from standard RAT functionality, change the last write timestamp of a selected file and load any received DLL binary from [command-and-control] server," Avast security researcher Luigino Camastra said in a report published last week.
The RAT acts as a pathway to deliver the FudModule rootkit, which has been recently observed leveraging a now-patched admin-to-kernel exploit in the appid.sys driver (CVE-2024-21338, CVSS score: 7.8) to obtain a kernel read/write primitive and ultimately disable security mechanisms.
The Lazarus Group's use of job offer lures to infiltrate targets is not new. Dubbed Operation Dream Job, the long-running campaign has a track record of using various social media and instant messaging platforms to deliver malware.
These initial access vectors trick targets into launching a malicious optical disc image (ISO) file bearing three files, one of which masquerades as an Amazon VNC client ("AmazonVNC.exe") that, in reality, is a renamed version of a legitimate Windows application called "choice.exe."
The two other files, named "version.dll" and "aws.cfg," act as a catalyst to kick-start the infection chain. Specifically, the executable "AmazonVNC.exe" is used to side-load "version.dll," which, in turn, spawns an IExpress.exe process and injects into it a payload residing within "aws.cfg."
The payload is designed to download shellcode from a command-and-control (C2) domain ("henraux[.]com"), which is suspected to be an actual-but-hacked website belonging to an Italian company that specializes in excavating and processing marble and granite.
While the exact nature of the shellcode is unclear, it's said to be used to launch RollFling, a DLL-based loader that serves to retrieve and launch the next-stage malware named RollSling, which was disclosed by Microsoft last year in connection with a Lazarus Group campaign exploiting a critical JetBrains TeamCity flaw (CVE-2023-42793, CVSS score: 9.8).
RollSling, executed directly in memory in a likely attempt to evade detection by security software, represents the next phase of the infection procedure. Its primary function is to trigger the execution of a third loader dubbed RollMid that's also run in the system's memory.
RollMid comes fitted with capabilities to set the stage for the attack and establish contact with a C2 server, which involves a three-step process of its own as follows -
- Communicate with the first C2 server to fetch a HTML file containing the address of the second C2 server
- Communicate with the second C2 server to fetch a PNG image that embeds a malicious component using a technique called steganography
- Transmit data to the third C2 server using the address specified in the concealed data within the image
- Retrieve an additional Base64-encoded data blob from the third C2 server, which is the Kaolin RAT
The technical sophistication behind the multi-stage sequence, while no doubt complex and intricate, borders on overkill, Avast opined, with the Kaolin RAT paving the way for the deployment of the FudModule rootkit after setting up communications with the RAT's C2 server.
On top of that, the malware is equipped to enumerate files; carry out file operations; upload files to the C2 server; alter a file's last modified timestamp; enumerate, create, and terminate processes; execute commands using cmd.exe; download DLL files from the C2 server; and connect to an arbitrary host.
"The Lazarus group targeted individuals through fabricated job offers and employed a sophisticated toolset to achieve better persistence while bypassing security products," Camastra said.
"It is evident that they invested significant resources in developing such a complex attack chain. What is certain is that Lazarus had to innovate continuously and allocate enormous resources to research various aspects of Windows mitigations and security products. Their ability to adapt and evolve poses a significant challenge to cybersecurity efforts."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/04/north-koreas-lazarus-group-deploys-new.html