Security Affairspublished Jul 15, 21:23 UTC (Jul 15, 2021)ingested Sep 10, 06:12 UTC@securityaffairs

Israeli surveillance firm Candiru used Windows 0days to deploy spyware

criticalMalwareimportance 60CVE-2021-31979 CVE-2021-33771

Read the original

Tagscve-2021-31979 cve-2021-33771 malware

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2021-33771 +1 in the same advisory: …31979	Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild (CVE-2021-33771) CVE-2021-33771 is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Windows kernel that allows a low-privileged user who can already execute code on a local machine to escalate to kernel-level (SYSTEM) privileges, with high impact on confidentiality, integrity and availability and no user interaction required. It is triggered locally, for example by running a malicious process or planted component on an affected system, and because it grants full SYSTEM rights it is typically chained with another flaw (such as a browser or document exploit) to escape a sandbox or complete an intrusion. Affected products span every mainstream Windows release current at disclosure: Windows 10 versions 1507, 1607, 1809, 1909, 2004, 20H2 and 21H1, Windows 8.1 and Windows RT 8.1, and Windows Server 2004, 2012 and 2016. The flaw was exploited before a patch existed; it was fixed in Microsoft's July 2021 Patch Tuesday (reported as 117 flaws including 9 zero-days, 4 actively exploited) and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, with EPSS in the 95th percentile (~10% probability of exploitation within 30 days). Related coverage links the Windows zero-days patched in July 2021 to spyware operations by the Israeli surveillance vendor Candiru targeting journalists and activists, indicating targeted in-the-wild use rather than mass commodity exploitation. Do: Apply Microsoft's July 2021 (or later) cumulative security updates to all affected Windows 10, 8.1, RT 8.1 and Windows Server hosts and verify the kernel update is installed, prioritizing KEV-driven remediation. Given the reported use in targeted spyware campaigns against journalists and activists, hunt on systems that ran unpatched builds for signs of compromise, such as unexpected process creation by low-privileged users, novel persistence, or unusual outbound traffic.	7.8	10%	KEV	microsoft Windows 10 version 1507 builds prior to the July 2021 security update microsoft Windows 10 version 1607 builds prior to the July 2021 security update microsoft Windows 10 version 1809 builds prior to the July 2021 security update +9 more	masshundreds of millions to 1 billion+ Windows devices and servers	Jul 14, 2021

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2021-33771

+1 in the same advisory: …31979

Privilege Escalation in Microsoft Windows Kernel Exploited in the Wild (CVE-2021-33771)

CVE-2021-33771 is a high-severity (CVSS 3.1: 7.8) elevation-of-privilege flaw in the Windows kernel that allows a low-privileged user who can already execute code on a local machine to escalate to kernel-level (SYSTEM) privileges, with high impact on confidentiality, integrity and availability and no user interaction required. It is triggered locally, for example by running a malicious process or planted component on an affected system, and because it grants full SYSTEM rights it is typically chained with another flaw (such as a browser or document exploit) to escape a sandbox or complete an intrusion. Affected products span every mainstream Windows release current at disclosure: Windows 10 versions 1507, 1607, 1809, 1909, 2004, 20H2 and 21H1, Windows 8.1 and Windows RT 8.1, and Windows Server 2004, 2012 and 2016. The flaw was exploited before a patch existed; it was fixed in Microsoft's July 2021 Patch Tuesday (reported as 117 flaws including 9 zero-days, 4 actively exploited) and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, with EPSS in the 95th percentile (~10% probability of exploitation within 30 days). Related coverage links the Windows zero-days patched in July 2021 to spyware operations by the Israeli surveillance vendor Candiru targeting journalists and activists, indicating targeted in-the-wild use rather than mass commodity exploitation.

Do: Apply Microsoft's July 2021 (or later) cumulative security updates to all affected Windows 10, 8.1, RT 8.1 and Windows Server hosts and verify the kernel update is installed, prioritizing KEV-driven remediation. Given the reported use in targeted spyware campaigns against journalists and activists, hunt on systems that ran unpatched builds for signs of compromise, such as unexpected process creation by low-privileged users, novel persistence, or unusual outbound traffic.

7.8

10%

KEV

microsoft Windows 10 version 1507 builds prior to the July 2021 security update
microsoft Windows 10 version 1607 builds prior to the July 2021 security update
microsoft Windows 10 version 1809 builds prior to the July 2021 security update
+9 more

masshundreds of millions to 1 billion+ Windows devices and servers

Jul 14, 2021

Full article525 words · extracted from securityaffairs.com · click to collapse

Experts said that Israeli surveillance firm Candiru, tracked as Sourgum, exploited zero-days to deliver a new Windows spyware.

Microsoft and Citizen Lab believe that the secretive Israel-based Israeli surveillance firm Candiru, tracked as Sourgum, used Windows zero-day exploits to deliver a new Windows spyware dubbed DevilsTongue.

According to the experts, at least 100 activists, journalists and government dissidents across 10 countries were targeted with Candiru’s spyware.

“A world where private sector companies manufacture and sell cyberweapons is more dangerous for consumers, businesses of all sizes and governments. We take this threat seriously and have disrupted the use of certain cyberweapons manufactured and sold by a group we call Sourgum.” reads the post published by Microsoft. “The weapons disabled were being used in precision attacks targeting more than 100 victims around the world including politicians, human rights activists, journalists, academics, embassy workers and political dissidents.”

Candiru sells surveillance software exclusively to governments, its spyware could spy on iPhones, Androids, Macs, PCs, and cloud accounts.

“Working with Microsoft Threat Intelligence Center (MSTIC) we analyzed the spyware, resulting in the discovery of CVE-2021-31979 and CVE-2021-33771 by Microsoft, two privilege escalation vulnerabilities exploited by Candiru. Microsoft patched both vulnerabilities on July 13th, 2021.” reads the report published by Citizen Lab.

“As part of their investigation, Microsoft observed at least 100 victims in Palestine, Israel, Iran, Lebanon, Yemen, Spain, United Kingdom, Turkey, Armenia, and Singapore. Victims include human rights defenders, dissidents, journalists, activists, and politicians.”

According to TheMarker, Candiru’s spyware can be deployed through different vectors, including malicious links, man-in-the-middle attacks, and physical attacks. The firm also offers an infection vector named “Sherlock” that works on Windows, iOS, and Android. Citizen Labs experts believe that Sherlock may be a browser-based zero-click vector.

While investigating some attacks, Citizen Labs spotted the presence of malware that exploited CVE-2021-31979 and CVE-2021-33771 zero-day vulnerabilities. Both issues were fixed by Microsoft with the release of July Patch Tuesday security updates.

Using Internet scanning, researchers identified more than 750 websites belonging to Candiru’s spyware infrastructure. The company used domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter movement, as well as media companies, and other civil-society-themed entities.

DevilsTongue allows operators to spy on the victims, collect sensitive data, decrypt and steal Signal messages on Windows devices, steal info for major web browsers.

DevilsTongue spyware could send messages from logged-in email and social media accounts using the infected system. Operators could use this feature to send malicious messages to the victim’s contacts.

“Candiru’s apparent widespread presence, and the use of its surveillance technology against global civil society, is a potent reminder that the mercenary spyware industry contains many players and is prone to widespread abuse. This case demonstrates, yet again, that in the absence of any international safeguards or strong government export controls, spyware vendors will sell to government clients who will routinely abuse their services. Many governments that are eager to acquire sophisticated surveillance technologies lack robust safeguards over their domestic and foreign security agencies.” concludes Citizen Labs.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Sourgum)

[adrotate banner=”5″]

[adrotate banner=”13″]

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/120175/malware/candiru-windows-zero-days-spyware.html