Talos discovered Spelevo EK, an exploit kit spreading via B2B Website
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-15982 | Use-After-Free in Adobe Flash Player Allows Arbitrary Code Execution CVE-2018-15982 is a use-after-free flaw (CWE-416) in Adobe Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier, in which Flash frees memory that is subsequently reused, corrupting process memory. It is triggered when Flash processes crafted Flash content, most notably embedded in Microsoft Office documents, requiring a user to open or view the malicious content (CVSS attack vector is local with user interaction required). Successful exploitation gives the attacker arbitrary code execution with the privileges of the user viewing the content. Affected users include anyone running the listed Flash Player versions, including the Flash Player Installer and the Adobe-supplied Flash plugin shipped with Red Hat Enterprise Linux Desktop, Server and Workstation. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use, a public exploit is available on Exploit-DB, and EPSS assigns a top-percentile 89.1% probability of exploitation within 30 days. Do: Flash Player is end-of-life: per CISA's required action, remove or disconnect Flash wherever it is still in use; if Flash must remain, update beyond the affected 31.0.0.153/31.0.0.108 builds and update the flash-plugin package on Red Hat Enterprise Linux. Mitigate the known delivery vector by blocking or disabling embedded Flash (SWF) content in Microsoft Office documents and mail clients, and hunt for suspicious documents with embedded Flash given the known in-the-wild and ransomware use. | 7.8 | 89% | KEV ransomware PoC |
| mass≈100M+ endpoints historically (Flash was preinstalled/bundled across most Windows desktops and shipped with Chrome and RHEL in 2018); only residual legacy… | |
| CVE-2018-8174 | Out-of-Bounds Write RCE in Microsoft Windows VBScript Engine CVE-2018-8174 is an out-of-bounds write (CWE-787) in the Microsoft Windows VBScript engine, caused by the way it handles objects in memory. An attacker triggers it by convincing a user to visit a specially crafted website or open crafted content that invokes the VBScript engine (for example via Internet Explorer or a document preview), requiring user interaction. Successful exploitation yields remote code execution with the privileges of the logged-on user, enabling program installation, data theft and account takeover. All listed Windows client and server releases are affected: Windows 7, 8.1, RT 8.1, Windows 10 (1607-1803), and Windows Server 2008/2008 R2, 2012/2012 R2, 2016. Exploitation is in the wild: the flaw was fixed in the May 2018 Patch Tuesday, is listed in CISA KEV with known ransomware use, and public PoCs (0patch, ExploitDB 44741) and exploit kit usage have been documented; EPSS puts its 30-day exploitation probability at 88.5%. Do: Apply Microsoft's May 2018 security updates (and any later cumulative or Extended Security Updates) to every listed Windows client and server release, as required by the CISA KEV listing, prioritizing internet-reachable and user-facing systems given known ransomware use. Upgrade out-of-support platforms (Windows 7/8.1/RT 8.1, Server 2008/2008 R2, 2012/2012 R2) to supported builds or ensure ESU coverage. As interim mitigation, block VBScript execution in Internet Explorer web zones using Microsoft's documented Group Policy/registry settings, and hunt for prior exploitation on legacy systems. | 7.5 | 88% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (affected desktop releases dominated the ~1B+ device Windows install base at disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | ezylifebags.com.au | ion gate used for the campaign. The gate is being hosted at ezylifebags[.]com[.]au, but experts also noticed a request for another JavaScr |
| domain | your-prizes-box.life | ticed a request for another JavaScript file being hosted at your-prizes-box[.]life. “However, this request doesn’t result in anything but ad |
Full article565 words · extracted from securityaffairs.com · click to collapse
Researchers at Cisco Talos group have discovered a new exploit kit dubbed Spelevo that spreads via a compromised business-to-business website.
Malware researchers at Cisco Talos have discovered a new exploit kit dubbed Spelevo that spreads via a compromised business-to-business website.
The popularity of EK rapidly decreased with the demise of the Angler Exploit Kit, but the discovery of the Spelevo exploit kit demonstrates that crooks continue to leverage on EKs to deliver malware.
Threat actors compromised a website to spread the Spelevo EK, they added only four lines of code that allowed to hack visitors with poor security hygiene.
“Today, Cisco Talos is unveiling the details of a new exploit kit campaign that proves exploit kits are still a threat and should be taken seriously by defenders: Spelevo.” reads the analysis published by Cisco Talos. “This recent campaign leveraged a compromised business-to-business site to deliver Spelevo, one of the first new kits we’ve seen in months.”
Attackers infected multiple pages on theB2B site were, and all of them were redirecting to the infection gate used for the campaign.
The gate is being hosted at ezylifebags[.]com[.]au, but experts also noticed a request for another JavaScript file being hosted at your-prizes-box[.]life.
“However, this request doesn’t result in anything but additional requests for the same file via 301 redirect and could be used as an additional tracker to ensure the victim is getting to the gate via the proper channels, a compromised website, and are not direct connects from researchers.” continues the experts.
The Spelevo’s attack chain begins with a request for the landing page, where an initial reconnaissance activity is performed. The malicious code collects information on the infected systems, including operating system, web browser, and applicable plugins.
The malware first attempts to exploit the CVE-2018-15982 is a vulnerable version of Adobe Flash was found, otherwise, the EK attempts to exploit a use-after-free in the VBScript engine of Internet Explorer tracked as CVE-2018-8174.
Once compromised the system, the Spelevo EK redirects the victim to Google. The user would notice a browser tab opening to load the infection gate, followed by the landing page, an exploit page, and then Google.
“Once the system has been compromised and the payload is delivered, Spelevo does something a bit novel for exploit kits: It redirects to Google, post compromise. The practical effect of which is that a user would see a tab open which loads the gate, followed by the landing page, an exploit page, and then finally to Google.” continues the analysis.
The campaign observed by Talos that involved the Spelevo EK was observed delivering the IcedID and Dridex Trojans.
Since its discovery, operators behind Spelevo have already implemented some minor changes, including modification of URL structure and some obfuscation changes in the landing and exploit pages themselves.
Unlike the Rig exploit kit, Spelevo is being hosted using domains instead of hard coded IP addresses, the operators behind the recently discovered EK leverage domain shadowing for that.
“In much the same way that we see old threats like MyDoom and Stuxnet circulating on the internet today, exploit kits will be a permanent part of the threat landscape.” Talos concludes. “They are still incredibly effective at leveraging existing vulnerabilities to randomly compromise victims on the internet to deliver a malicious payload,”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Spelevo EK, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/87721/malware/spelevo-exploit-kit.html