Energy companies infected by newly Laziok trojan malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) CVE-2012-0158 is a remote code execution flaw in Microsoft's MSCOMCTL.OCX, the Windows Common Controls ActiveX component, where improper handling of crafted input allows memory corruption and code execution. It is typically triggered when an application that uses the control (most commonly Microsoft Office) processes specially crafted content, such as a malicious document or file, meaning a victim usually has to open attacker-supplied content. Successful exploitation lets an attacker run arbitrary code and take complete control of the affected system with the privileges of the current user. Any Windows system carrying a vulnerable copy of MSCOMCTL.OCX — including systems where the control was redistributed by legacy applications — is affected, which makes the potential population very large. Exploitation is confirmed and ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, and EPSS assigns it the maximum reported probability of exploitation within 30 days. Do: Apply the Microsoft security update for MSCOMCTL.OCX (per vendor instructions, per CISA's required action) on all systems, prioritizing endpoints and servers that open Office documents. Because exploitation commonly arrives via malicious documents, treat unsolicited Office/RTF attachments with suspicion and verify that applications that redistribute MSCOMCTL.OCX have installed a patched copy. Scan the estate for the presence and version of MSCOMCTL.OCX, especially on legacy Windows/Office installations that may be missed by routine patching. | — | 100% | KEV ransomware |
| masshundreds of millions of Windows systems potentially affected |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | moneytrans.eu | r phishing attack, the emails used by hackers come from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer |
Full article550 words · extracted from securityaffairs.com · click to collapse
Symantec has discovered a cyber espionage campaign targeting energy companies around the world by infecting them with a new malware dubbed Laziok trojan.
Security experts at Symantec have uncovered a new cyber espionage campaign that targeted the energy industry. The threat actors behind the campaign used uses a custom-developed malware dubbed Laziok trojan to exfiltrate sensitive data from energy companies around the world. The United Arab Emerates was the country with the highest number of infections (25%), followed by Saudi Arabia (20%), Pakistan (10%), and Kuwait (10%).
Trojan. Laziok was designed for reconnaissance activities, it collects data on target systems, including machine name, installed antivirus software, installed applications, CPU and GPU details, RAM size and hard disk size.
“Between January and February, we observed a multi-staged, targeted attack campaign against energy companies around the world, with a focus on the Middle East. This attack campaign used a new information stealer, detected by Symantec as Trojan.Laziok. Laziok acts as a reconnaissance tool allowing the attackers to gather data about the compromised computers.” states a blog post published by Symantec.
The data collected by Trojan.Laziok are used by bad actors to tune the attack against the targeted companies, the information help the attackers to decide which malware use to breach the systems. The operators behind the malicious campaign used other malware to target their attacks against specific companies, the attackers used versions of Backdoor.Cyberat and Trojan.Zbot to infect systems with specific configurations.
“The detailed information enables the attacker to make crucial decisions about how to proceed further with the attack, or to halt the attack. During the course of our research, we found that the majority of the targets were linked to the petroleum, gas and helium industries, suggesting that whoever is behind these attacks may have a strategic interest in the affairs of the companies affected.”
The attack chain starts with a spear phishing attack, the emails used by hackers come from the moneytrans[.]eu domain, which acts as an open relay Simple Mail Transfer Protocol (SMTP) server. The e-mails contain an attachment, typically in the form of an Excel file, that exploits a well-known Microsoft Windows vulnerability patched in 2012 and that was exploited by threat actors behind Red October and CloudAtlas campaigns.
“These emails include a malicious attachment packed with an exploit for the Microsoft Windows Common Controls ActiveX Control Remote Code Execution Vulnerability (CVE-2012-0158). This vulnerability has been exploited in many different attack campaigns in the past, such as Red October. ” explains Symantec.
The experts confirmed that bad actors that used Trojan.Laziok malware to target energy companies haven’t adopted sophisticated hacking technique, the investigation demonstrated that they exploited only an old vulnerability by using exploit kits easy to find in the underground market. However, many people still fail to apply patches for vulnerabilities that are several years old, leaving themselves open to attacks of this kind. From the attacker’s perspective, they don’t always need to have the latest tools at their disposal to succeed. All they need is a bit of help from the user and a lapse in security operations through the failure to patch.
As usual, let me suggest you to keep your systems secure by applying security patches for vulnerabilities.
(Security Affairs – Trojan.Laziok, hacking)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/35567/cyber-crime/energy-companies-laziok-trojan.html