State-sponsored APTs are leveraging WinRAR bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) | |
| CVE-2023-40477 | RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233. NVD description · AI analysis pending | 7.8 | 11% |
| — |
Full article396 words · extracted from helpnetsecurity.com · click to collapse
A number of government-backed APTs are exploiting CVE-2023-38831, a file extension spoofing vulnerability in WinRAR, a widely used file archiver utility for Windows.
CVE-2023-38831 has been patched in August 2023, along with another high-severity RCE vulnerability (CVE-2023-40477).
Exploited as a zero-day by cybercriminals since April 2023, the vulnerability is now also being used by state-sponsored hacking groups.
“The widespread exploitation of the WinRAR bug highlights that exploits for known vulnerabilities can be highly effective, despite a patch being available,” Google TAG analysts have noted.
A proof of concept for generating ZIP archives capable of triggering CVE-2023-38831 is available online.
Phishing emails carry exploits
Google’s analysts have flagged several campaigns using CVE-2023-38831 and have shared IoCs related to all of those attacks.
The infamous Sandworm hackers impersonated a Ukrainian drone warfare training school in early September. The emails they sent out contained an invitation to join the school and a booby-trapped archive file that, when unpacked with a vulnerable version of WinRAR, would also run the Rhadamanthys infostealer.
Around the same time, Fancy Bear (APT28) – which is also believed to be sponsored by the Russian government – targeted Ukrainians working in the energy sector with a fake event invitation from a public policy think tank in Ukraine.
Google researchers also analyzed a file (IOC_09_11.rar) that was uploaded on VirusTotal in September and that triggers a PowerShell script that steals browser login data and local state directories.
Researchers with DuskRise’s Cluster25 threat intelligence team say that the file appears to contain indicators of compromise (IoCs) for a variety of malware, but also triggers the WinRAR flaw and the launching of PowerShell commands that open a reverse shell on the target machine and exfiltrate login credentials stored in Google Chrome and Microsoft Edge.
“According to the Cluster25 visibility and considering the sophistication of the infection chain, the attack could be related with low-to-mid confidence to the Russian state-sponsored group APT28 (aka Fancy Bear, Sednit),” they added.
Finally, Google says that a recent phishing campaign targeting Papua New Guinea with a ZIP archive containing the CVE-2023-38831 exploit and leading to the download of a backdoor, was mounted by government-backed groups linked to China.
“Even the most sophisticated attackers will only do what is necessary to accomplish their goals,” Google’s analysts pointed out. Obviously, these threat actors are counting on organizations lagging behind with critical patches.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/10/18/apts-winrar-cve-2023-38831/