NK-linked InkySquid APT leverages IE exploits in recent attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content. | 7.8 | 24% | KEV |
| masshundreds of millions of Windows devices historically able to run Internet Explorer; exact currently-vulnerable count unknown | |
| CVE-2021-26411 | Use-After-Free Memory Corruption in Microsoft Internet Explorer Exploited in the Wild CVE-2021-26411 is a use-after-free (CWE-416) memory corruption vulnerability in Microsoft Internet Explorer's web rendering engine that can lead to remote code execution. It is triggered when a user, typically lured via a link, email, or watering-hole page, views attacker-controlled web content that corrupts memory, consistent with the CVSS profile requiring network access and user interaction. A successful attacker gains code execution in the context of the logged-on user, which in observed campaigns was chained into malware delivery (including exploit-kit payloads such as Dridex and VBA-based malware). Any Windows system that renders web content with Internet Explorer or its IE/MSHTML components (Edge is also listed among affected CPE products) is potentially affected, though specific version ranges are not provided in the source data. The flaw was exploited as a zero-day around Microsoft's March 2021 Patch Tuesday, was added to CISA KEV on 2021-11-03 with known ransomware use, and carries an 80.8% EPSS probability of exploitation within 30 days. Do: Apply Microsoft's March 2021 cumulative security updates for Internet Explorer, or any later cumulative update, across all Windows clients and servers, prioritizing user workstations per the CISA KEV required action. Review proxy and endpoint logs for visits to compromised watering-hole sites (notably Korean-language news sites) and for follow-on malware such as Dridex, and restrict or disable IE/legacy IE-mode rendering of untrusted web content where feasible. | 8.8 | 81% | KEV ransomware |
| mass≈hundreds of millions of Windows endpoints (IE/MSHTML components are present on effectively all supported Windows clients and servers) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | dailynk.com | ks aimed at the Daily NK South Korean online newspaper (www.dailynk[.]com). APT37 has been active since at least 2012, it mainly ta |
| domain | jquery.services | was loaded via www.dailynk[.]com to malicious subdomains of jquery[.]services . Below some examples of URLs used to load malicious code |
| url | https://www.dailynk[ | . Below some examples of URLs used to load malicious code: hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1 hxxps:// |
Full article575 words · extracted from securityaffairs.com · click to collapse
North Korea-linked InkySquid group leverages two Internet Explorer exploits to deliver a custom implant in attacks aimed at a South Korean online newspaper.
Experts from cybersecurity firm Volexity reported that North Korea-linked InkySquid group (aka ScarCruft, APT37, Group123, and Reaper) leverages two Internet Explorer exploits to deliver a custom backdoor in watering hole attacks aimed at the Daily NK South Korean online newspaper (www.dailynk[.]com).
APT37 has been active since at least 2012, it mainly targeted government, defense, military, and media organizations in South Korea.
The watering hole attacks on the Daily NK was conducted from March 2021 until early June 2021.
“The use of recently patched exploits for Internet Explorer and Microsoft Edge will only work against a limited audience.” reads the post published by Volexity. “Attackers will still have some success, however, and have a good chance of avoiding detection based on the following attributes of their attack:
- Clever disguise of exploit code amongst legitimate code, making it harder to identify
- Only allowing exploitable user-agents access to the exploit code, making it difficult to identify at scale (such as through automated scanning of websites)
- Use of innovative custom malware, such as BLUELIGHT, after successful exploitation using C2 mechanisms which are unlikely to be detected by many solutions”
The researchers discovered a suspicious code that was loaded via www.dailynk[.]com to malicious subdomains of jquery[.]services. Below some examples of URLs used to load malicious code:
- hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
- hxxps://www.dailynk[.]com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
The attackers modified the content of legitimate files used by the website and included the code to redirect users to load malicious JavaScript from the attacker-owned domain jquery[.]services. The attackers included the malicious code only for short periods of time making hard the detection of the attack.
The threat actors leverage exploits for two Internet Explorer vulnerabilities, tracked as CVE-2020-1380 and CVE-2021-26411, that were respectively patched in August 2020 and March 2021.
CVE-2020-1380 is a Scripting Engine Memory Corruption Vulnerability that received a CVSS score of 7.5, while the CVE-2021-26411 was an Internet Explorer Memory Corruption vulnerability that received a CVSS score of 8.8.
Both vulnerabilities have been actively exploited in the wild by threat actors and the CVE-2021-26411 was already exploited by North Korean APT groups in attacks aimed at security researchers working on vulnerability research in January.
According to the experts, BLUELIGHT is used as a second-stage payload after the successful delivery of the initial Cobalt Strike payload.
BLUELIGHT was used to gather intelligence on the infected system and to provide remote access to the attackers, it supports the following commands:
- Execute downloaded shellcode.
- Download and launch an executable, then upload program output.
- Harvest cookies and a password database for supported browsers.
— Supports: Win7 IE, Win10 IE, Edge, Chrome, and Naver Whale - Recursively search a path and upload file metadata (timestamps, size, and full path).
- Spawn a thread to recursively search a path and upload files as a ZIP archive.
- Terminate the file upload thread.
- Uninstall the implant.
“While SWCs are not as popular as they once were, they continue to be a weapon in the arsenal of many attackers. The use of recently patched exploits for Internet Explorer and Microsoft Edge will only work against a limited audience. Attackers will still have some success, however, and have a good chance of avoiding detection base” concludes the experts.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, InkySquid)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/121262/apt/inkysquid-apt-ie-exploirs.html