Google TAG Detects State-Backed Threat Actors Exploiting WinRAR Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-38831 | Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion RARLAB WinRAR before 6.23 mishandles ZIP archives that contain a benign file (such as a JPG) alongside a folder with the same name, causing the folder's contents - which can include malicious executable files - to be processed when the user merely attempts to view the benign file. By sending a crafted ZIP archive, an attacker gains arbitrary code execution on the victim's machine with the user's privileges. Because the flaw is local (AV:L) and requires user interaction, risk is limited to Windows systems running an unpatched copy of WinRAR, while machines without the tool are unaffected. The bug was actively exploited in the wild from April through October 2023, including by government-backed actors (APT28), SideCopy attacks on Indian government entities, ransomware operations, and trading-account theft campaigns, and it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-08-24. Do: Upgrade all Windows systems running WinRAR to version 6.23 or later, which fixes this flaw; if patching is not immediately possible, treat ZIP files from untrusted sources with caution and check archives for duplicate file/folder names before opening. Given KEV listing with known ransomware use and public proof-of-concept exploits, hunt for compromise by reviewing whether unexpected executables or scripts ran when ZIP archives were opened, and apply vendor mitigations per CISA's required action or discontinue use if mitigations are unavailable. | 7.8 | 98% | KEV ransomware PoC ×4 |
| masshundreds of millions of users/installations worldwide (WinRAR is one of the most widely installed Windows archive utilities) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | ts the information to an actor-controlled infrastructure on webhook[.]site. The third threat actor to exploit the WinRAR bug is APT4 |
Full article462 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 19, 2023Cyber Threat / Vulnerability
A number of state-back threat actors from Russia and China have been observed exploiting a recent security flaw in the WinRAR archiver tool for Windows as part of their operations.
The vulnerability in question is CVE-2023-38831 (CVSS score: 7.8), which allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The shortcoming has been actively exploited since at least April 2023.
Google Threat Analysis Group (TAG), which detected the activities in recent weeks, attributed them to three different clusters it tracks under the geological monikers FROZENBARENTS (aka Sandworm), FROZENLAKE (aka APT28), and ISLANDDREAMS (aka APT40).
The phishing attack linked to Sandworm impersonated a Ukrainian drone warfare training school in early September and distributed a malicious ZIP file exploiting CVE-2023-38831 to deliver Rhadamanthys, a commodity stealer malware which is offered for sale for $250 for a monthly subscription.
APT28, also affiliated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) as it's the case with Sandworm, is said to have launched an email campaign targeting government organizations in Ukraine.
In these attacks, users from Ukraine were prompted to download a file containing a CVE-2023-38831 exploit – a decoy document that masqueraded as an event invitation from Razumkov Centre, a public policy think tank in the country.
The result is the execution of a PowerShell script named IRONJAW that steals browser login data and local state directories and exports the information to an actor-controlled infrastructure on webhook[.]site.
The third threat actor to exploit the WinRAR bug is APT40, which unleashed a phishing campaign targeting Papua New Guinea in which the email messages included a Dropbox link to a ZIP archive containing the CVE-2023-38831 exploit.
The infection sequence ultimately paved the way for the deployment of a dropper named ISLANDSTAGER that's responsible for loading BOXRAT, a .NET backdoor that uses the Dropbox API for command-and-control
The disclosure builds upon recent findings from Cluster25, which detailed attacks undertaken by the APT28 hacking crew exploiting the WinRAR flaw to conduct credential harvesting operations.
Some of the other state-sponsored adversaries that have joined the fray are Konni (which shares overlaps with a North Korean cluster tracked as Kimsuky) and Dark Pink (aka Saaiwc Group), according to findings from the Knownsec 404 team and NSFOCUS.
"The widespread exploitation of the WinRAR bug highlights that exploits for known vulnerabilities can be highly effective, despite a patch being available," TAG researcher Kate Morgan said. "Even the most sophisticated attackers will only do what is necessary to accomplish their goals."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/10/google-tag-detects-state-backed-threat.html