New JNEC.a Ransomware delivered through WinRAR exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-20250 | Absolute Path Traversal in RARLAB WinRAR ACE Extraction (UNACEV2.dll) WinRAR versions through 5.61 contain a path traversal flaw (CWE-22, also mapped to CWE-36) in the UNACEV2.dll library used to unpack ACE-format archives: when a crafted archive's filename field contains absolute-path patterns, WinRAR ignores the user-selected extraction destination and writes the file to any absolute path the attacker specifies. It is triggered by inducing a user to open a malicious ACE archive (user interaction required), allowing arbitrary file placement on the endpoint — for example, writing an executable to a Windows startup folder to achieve code execution at next logon, as demonstrated in the original Check Point research. Only RARLAB WinRAR is affected, and the issue was assigned by Check Point acting as CNA, with multiple public proofs of concept available. Exploitation is well established: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use (e.g., JNEC.a delivered via this exploit), has been linked to targeted-activity by threat actors, and EPSS currently assigns a 96.3% probability of exploitation within 30 days. Because WinRAR lacks an automatic update mechanism, stale installations remained exposed and under active attack long after the vendor fix was published. Do: Apply updates per vendor instructions by upgrading to a WinRAR release newer than 5.61, in which the vulnerable ACE handling is patched or replaced; ensure endpoints actually run the updated build given WinRAR does not auto-update. If patching cannot be done promptly, delete or neutralize UNACEV2.dll (disabling ACE extraction) or unpack ACE archives with a patched alternative, and scrutinize ACE attachments arriving via email. Hunt for unexpected files dropped into auto-run locations (e.g., startup folders) and treat this as a KEV entry with the corresponding federal remediation deadline. | 7.8 | 96% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows desktop installations (every WinRAR release up to 5.61 is vulnerable) |
Full article417 words · extracted from securityaffairs.com · click to collapse
A new strain of ransomware tracked as JNEC.a is spreading through an exploit that triggers the recently discovered vulnerability in WinRAR.
The ransomware was involved in the attacks observed by the Qihoo 360 Threat Intelligence Center in the wild, threat actors used an archive named “vk_4221345.rar” that delivers JNEC.a when its contents are extracted with a vulnerable version of WinRAR.
The vulnerability, tracked as CVE-2018-20250, was discovered by experts at Check Point in February, it could allow an attacker to gain control of the target system.
Over 500 million users worldwide use the popular software and are potentially impacted by the flaw that affects all versions of released in the last 19 years.
The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive.
The ransomware encrypts data on the victim’s machine and appends the .Jnec extension to the encrypted data asking a ransom 0.05 bitcoins (about $200).
Once the ransomware has encrypted the files on the victim’s computer, it will generate a Gmail address that victims need to create in order to receive the file decryption key once they will pay the ransom.
This way to identify infected machines represents a novelty in the threat landscape, victims must register the Gmail account provided by the ransomware in order to receive the decryption keys.
The JNEC.a ransomware also drops a ransom note (JNEC.README.TXT) on the infected computer to provide instructions on how to make the payment.
JNEC.a is written in .NET, when the archive is decompressed it shows a corrupted image of a girl that triggers an error and shows an incomplete picture, meanwhile the ransomware is already delivered to the computer.
The attackers renamed the malware dropped in the Startup folder as ‘GoogleUpdate.exe’ in the attempt to deceive the victims.
A few days ago, McAfee reported that attackers are continuing in exploiting the WinRAR flaw in the wild, they identified more than “100 unique exploits and counting” in the first week since the vulnerability was publicly disclosed.
The JNEC.a ransomware still has a low detection rate, it was identified as malicious by 31/71 antivirus of the VirusTotal services.
At the moment of writing, 29 antivirus engines detect JNEC.a as threat, according to the popular malware researcher Michael Gillespie a bug in its code makes it impossible to decrypt files even for the developer.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – JNEC.a ransomware, hacking )
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/82606/malware/jnec-a-ransomware-winrar.html