Ukraine's CERT Thwarts APT28's Cyberattack on Critical Energy Infrastructure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) |
Full article332 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 06, 2023Cyber Attack / Critical Infrastructure
The Computer Emergency Response Team of Ukraine (CERT-UA) on Tuesday said it thwarted a cyber attack against an unnamed critical energy infrastructure facility in the country.
The intrusion, per the agency, started with a phishing email containing a link to a malicious ZIP archive that activates the infection chain.
“Visiting the link will download a ZIP archive containing three JPG images (decoys) and a BAT file ‘weblinks.cmd’ to the victim’s computer,” CERT-UA said, attributing it to the Russian threat actor known as APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard, or FROZENLAKE).
“When a CMD file is run, several decoy web pages will be opened, .bat and .vbs files will be created, and a VBS file will be launched, which in turn will execute the BAT file.”
The next phase of the attack involves running the “whoami” command on the compromised host and exfiltrating the information, alongside downloading the TOR hidden service to route malicious traffic.
Persistence is achieved by means of a scheduled task and remote command execution is implemented using cURL through a legitimate service called webhook.site, which was recently disclosed as used by a threat actor known as Dark Pink.
CERT-UA said the attack was ultimately unsuccessful owing to the fact that access to Mocky and the Windows Script Host (wscript.exe) was restricted. It’s worth noting that APT28 has been linked to the use of Mocky APIs in the past.
The disclosure comes amid continued phishing attacks targeting Ukraine, some of which have been observed leveraging an off-the-shelf malware obfuscation engine named ScruptCrypt to distribute AsyncRAT.
Another cyber assault mounted by GhostWriter (aka UAC-0057 or UNC1151) is said to have weaponized a recently disclosed zero-day flaw in WinRAR (CVE-2023-38831, CVSS score: 7.8) to deploy PicassoLoader and Cobalt Strike, the agency said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/ukraines-cert-thwarts-apt28s.html