Op Buhtrap: New Spyware is targeting Russian Banking Sector
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days. Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching. | — | 100% | KEV ransomware |
| masshundreds of millions of Windows systems potentially affected |
Full article569 words · extracted from securityaffairs.com · click to collapse
ESET has discovered a new hacking campaign dubbed Operation Buhtrap based on a family of spyware targeting vulnerabilities within the Russian Windows System.
Late in 2014 analysts at ESET uncovered CVE-2012-0158, a buffer overflow vulnerability in the ListView / TreeView ActiveX controls in the MSCOMCTL.OCX library. This particular malicious code can be activated by a specially modified DOC or RTF file for MS Office versions 2003, 2007 and 2010. Even though this vulnerability was patched by Microsoft more than a year ago, it seems that cybercriminals have managed to find unpatched Russian Windows systems within the banking sector and exploited them.
“The tools deployed on the victim’s computer allow them to control it remotely and to record the user’s actions. The malware allows the criminals to install a backdoor, attempt to obtain the account password and even create a new account” -JEAN-IAN BOUTIN
ESET has dubbed the malware campaign Operation Buhtrap, a conjunction of the Russian word for accountant “Buhgalter” and the English word “trap”. So far Buhtrap has not been seen anywhere else in the wild, so is not likely to be widespread. So far approx. 88 per cent of targets have been in Russia and ten per cent in Ukraine. Analysts have also likened the campaign to the Anunak/Carbanak campaign, which also targeted Russian and Ukrainian Banks.
“Although we believe it to be a different campaign, it shares some similarities with Anunak/Carbanak in terms of techniques, tactics and procedures it use.”
The modus operandi of these particular cybercriminals is usually associated with targeted attacks rather than cyber fraud, which make this move to financial crime unusual. Their method of delivery is by email using an attached invoice document: “Счет № 522375-ФЛОРЛ-14-115.doc” as the attack mechanism.
A second decoy email used by the cybercriminals invites users to open a hoax contract “kontrakt87.doc”. This email purports to be from the fourth largest telecom operator in Russia, Megafon, giving the attachment a false sense of credibility.
Once the attachment has been opened the payload drops and executes a NSIS-packed trojan downloader. The cybercriminals command and control (C&C) server will then scan their environment and propagate the trojan in order to compromise other computers in the business. A further custom-made spyware that abuses Yandex’s Punto software carries out the spying and will relay information back to the C&C to see if it’s feasible to fraudulently divert funds.
“While the tools and software used in this campaign are far from being novel, the overall campaign is quite interesting and intriguing: it diverges quite a bit from the traditional banking malware with which we are familiar”.
Cybercrime in Russia in many ways is an old battle fought with new malware accessing “vulnerable” targets and permitting quick and unencumbered access and a profitable exit for the cybercriminals. It is currently not know how much money the cybercriminals have managed to steal nor do we know who was targeted, but we are sure that future analysis will provide more clues!
About the Author Kevin Gorman
Kevin Gorman is a Cyber Security Specialist at Sky UK a pan-European satellite broadcasting, on-demand Internet streaming media, broadband and telephone services company. He is also a former 25 year veteran of the British Army and is a member of the UK Security Institute and holds a Masters Degree in Intelligence and Security Studies from Brunel University’s Centre for Intelligence and Security Studies.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/35848/breaking-news/operation-buhtrap.html