Ukrainian remote workers targeted in new espionage campaign
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) |
Full article394 words · extracted from therecord.media · click to collapse
Researchers have identified a new cyber operation aimed at Ukrainian employees working outside of the country. The attacks, mostly carried out in August and November of this year, were attributed to a threat actor tracked as UAC-0099, according to a report by cybersecurity company Deep Instinct published this week. The espionage group has been attacking Ukraine since at least mid-2022. In a previous campaign in June, the hackers sought to spy on Ukrainian government organizations and media, according to Ukraine’s computer emergency response team (CERT-UA). The group’s tactics are “simple, yet effective,” according to Deep Instinct. In the phishing emails discovered by researchers, the hackers impersonated the city court in the western Ukrainian city of Lviv. The emails contained a file with a court summons that, once opened, executed malicious code that dropped the info-stealing malware called LonePage on the victim’s system. These malicious emails were sent to the corporate email boxes of Ukrainian employees working remotely for a company outside of Ukraine. In the attacks, the hackers exploited a high-severity vulnerability tracked as CVE-2023-38831. It’s a bug in the Windows file archiver tool WinRAR, which was abused by state-controlled hackers connected to Russia and China in early 2023 before being patched. UAC-0099 started to exploit the vulnerability several days after the patch, according to Deep Instinct, showing “the level of sophistication of the attackers.” The exploitation of this security flaw requires a user to interact with a specially crafted ZIP archive. The vulnerability might lead to high infection rates because the attacks are disguised so well, according to the report. “Even security-savvy victims can fall for the deception, researchers said. “Expecting to open a benign file, the user will inadvertently execute malicious code.” Even though the WinRAR vulnerability was fixed earlier this year, it doesn't mean that people are safe from attacks exploiting it. “WinRAR requires a manual update, meaning that even if a patch is available, many people will likely still have a vulnerable version of WinRAR installed,” researchers said.
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/ukraine-remote-workers-targeted-espionage-winrar-vulnerability