Sundown Exploit Kit now leverages on the steganography
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-2419 | Memory Corruption RCE in Microsoft Internet Explorer JScript Engine CVE-2015-2419 is a memory corruption flaw (CWE-119) in the JScript engine used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted website. It is triggered when a user visits an attacker-controlled page whose JScript content corrupts memory in the affected browser process. A successful attacker gains remote code execution in the context of the logged-on user (or crashes the browser), which makes drive-by and exploit-kit delivery routes viable. Any Windows user running the affected versions of Internet Explorer at the time of disclosure was exposed, and Microsoft shipped fixes as part of its July 2015 security updates. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), carries a 53.4% EPSS (99th percentile), and related reporting places it among the top vulnerabilities used by exploit kits in 2015-2016. Do: Apply Microsoft's July 2015 security updates for Internet Explorer per vendor instructions, as required by the CISA KEV catalog, and verify that any legacy Windows systems still running Internet Explorer have received them. Because exploitation typically occurs via drive-by web attacks, retire or fully patch IE on client endpoints and keep endpoint protection enabled to catch exploit-kit delivery. Confirm no workstations remain on unpatched IE builds, since this entry has been in CISA KEV since March 2022 and exploitation probability remains high (EPSS 53.4%). | — | 53% | KEV |
| masshundreds of millions of Windows users running Internet Explorer at the time of disclosure | |
| CVE-2016-0189 | Memory Corruption RCE in Microsoft IE Scripting Engines (JScript/VBScript) CVE-2016-0189 is a memory corruption flaw (out-of-bounds write, per CWE-787) in Microsoft's JScript 5.8 and VBScript 5.7/5.8 scripting engines, as used in Internet Explorer 9 through 11 and other products that embed those engines. It is triggered remotely when a user is lured into viewing a crafted website that mishandles script, corrupting memory in the browser process. A successful attacker gains arbitrary code execution in the context of the current user (or can crash the browser, causing denial of service), with no authentication required but user interaction needed. Anyone running Internet Explorer 9-11 on Windows, or other products using the affected scripting engines, was exposed. Exploitation is well established: public write-ups document its use in drive-by exploit kit attacks and subsequent 'God Mode' local privilege-escalation variants, it is listed in CISA KEV (added 2022-03-28) with known ransomware use, and EPSS assigns a 94.1% probability of exploitation within 30 days. Do: Apply the vendor-supplied Microsoft security updates for Internet Explorer and the JScript/VBScript scripting engines per CISA's required action, prioritizing endpoints used for web browsing and email since this is delivered via drive-by website attacks and is known to be used by ransomware operators. Systems that no longer receive updates for IE 9-11 should be migrated to a supported browser or OS. Check your environment against CISA KEV to confirm remediation status. | 7.5 | 94% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints at disclosure (IE 9-11 shipped as the default Windows browser); residual exposure on legacy/enterprise Windows… | |
| CVE-2016-4117 | Arbitrary Code Execution in Adobe Flash Player 21.0.0.226 and earlier CVE-2016-4117 is a critical (CVSS 3.1: 9.8) arbitrary code execution vulnerability in Adobe Flash Player 21.0.0.226 and earlier, in which unspecified vectors in the Flash runtime allow remote attackers to execute arbitrary code. It is triggered by delivering malicious Flash content over a network — for example a crafted SWF loaded by a browser or an application that embeds Flash — and, per its CVSS scoring, requires no privileges or authentication. A successful exploit gives the attacker code execution in the context of the Flash runtime (typically the user's browser process), which public reporting shows was used to deliver espionage tooling and, per CISA, is also known to be used in ransomware campaigns. Anyone running Flash Player 21.0.0.226 or earlier was affected, including users of the flash-player packages shipped for Red Hat Enterprise Linux Desktop, Server (including the RHUI variant) and Workstation, openSUSE, openSUSE Evergreen, and SUSE Linux Enterprise Desktop and the SUSE Linux Enterprise Workstation Extension. The bug was exploited in the wild in May 2016 — related headlines tie it to the BlackOasis APT 'Operation Daybreak' espionage campaign using FinFisher — and it was added to the CISA KEV on 2022-03-03 with known ransomware use and a very high 94.4% EPSS. Do: Per CISA's required action, Flash Player is end-of-life: remove or disable Flash wherever it is still present and uninstall the flash-player packages on any remaining RHEL, SUSE or openSUSE hosts, especially internet-facing systems. If a legacy system must keep Flash, ensure it runs a release later than 21.0.0.226 (a fixed build from the May 2016 Adobe update or later) and restrict it from untrusted web content. | 9.8 | 94% | KEV ransomware PoC |
| mass≈100M+ desktop users at the time of disclosure (Flash was then near-universal); residual small base of end-of-life installs today |
Full article564 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
December 30, 2016
A new variant of the Sundown exploit kit leverages on steganography to hide exploit code in harmless-looking image files.
Security experts from Trend Micro have spotted a new version of the Sundown exploit kit that exploits steganography in order to hide malicious code in harmless-looking image files.
The use of steganography was recently observed in the malvertising campaigns conducted by the AdGholas and GooNky groups.
The GooNky group leveraged on steganography to hide malvertising traffic, while AdGholas has used a more sophisticated technique leveraging the Stegano exploit kit.
Crooks encoded a script in the alpha channel of an image to deliver the malicious code via rogue ads that looked like legitimate.
Earlier in December, researchers from ESET discovered that Stegano hide portions of its malicious code in parameters controlling the transparency of pixels used to display banner ads, but the impact of the appearance of the images is almost imperceptible.
“The malicious version of the graphic has a script encoded in its alpha channel, which defines the transparency of each pixel. Since the modification is minor, the final picture’s color tone is only slightly different to that of the clean version” reads the analysis published by ESET.
A similar technique has been observed for a new version of the Sundown EK spotted by the researchers at Trend Micro on December 27.
“On December 27, 2016, we noticed that Sundown was updated to use similar techniques. The PNG files weren’t just used to store harvested information; the malware designers now used steganography to hide their exploit code.” reads the analysis published by Trend Micro.
The updated version of Sundown has been used in several malvertising campaigns, mostly targeting users in Japan, Canada, France and the US.
“The newly updated exploit kit was used by multiple malvertising campaigns to distribute malware. The most affected countries were Japan, Canada, and France, though Japanese users accounted for more than 30% of the total targets.”
The new Sundown EK leverages on hidden iframes that automatically connects to a page hosting the Sundown EK. The page downloads a white PNG image and decodes malicious code it contains.
“In this updated version, the exploit kit’s malvertisement creates a hidden iframe that automatically connects to the Sundown landing page,” continues the post.“The page will retrieve and download a white PNG image. It then decodes the data in this PNG file to obtain additional malicious code.”
Researchers from Trend Micro leveraged on malicious code to trigger Internet Explorer flaws CVE-2015-2419 and CVE-2016-0189, and the Flash Player flaw tracked as CVE-2016-4117.
The researchers observed threat actors leveraging on the Sundown EK to deliver the Chthonic banking Trojan, a variant of the infamous Zeus malware, that was used by crooks in a PayPal scam in July.
The Sundown EK ranks today at the second place, behind RIG EK that is the most used crimeware kit in the criminal ecosystem.
According to security experts from Cisco Talos, threat actors behind the Sundown exploit kit leverage on an infrastructure composed of 80,000 malicious subdomains associated with more than 500 domains.
The experts observed that crooks behind the Sundown EK are using wildcards for subdomains which are exponentially growing the number of routes for malicious traffic to servers hosting the dreaded exploit kit.
[adrotate banner=”9″]
(Security Affairs – Steganography, Sundown exploit kit)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/54886/cyber-crime/sundown-exploit-kit-2.html