NK Hackers Deploy Browser Exploits on South Korean Sites to Spread Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1380 | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine CVE-2020-1380 is a memory corruption vulnerability (an out-of-bounds write, CWE-787) in the Microsoft Internet Explorer scripting engine that can corrupt memory when the engine processes maliciously crafted script content. It is triggered by luring a user to visit an attacker-controlled or compromised web page in Internet Explorer or in an application that invokes the IE engine, with no authentication required. Successful exploitation allows the attacker to execute arbitrary code in the context of the current user, gaining that user's privileges on the system. All installations of the affected Microsoft Internet Explorer versions are potentially exposed, with the greatest risk to legacy and enterprise Windows systems that still browse or render content with IE. The flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild, while no public proof-of-concept is known and ransomware use is unconfirmed. Do: Apply Microsoft's June 2020 (or later) Windows cumulative security updates on every system running Internet Explorer, per the vendor instructions cited by CISA. Given the KEV listing (added 2021-11-03) and high EPSS (~24% 30-day exploitation probability, 98th percentile), treat this as a priority patch. Reduce attack surface by steering users to Microsoft Edge instead of IE for web browsing and auditing internal apps or legacy sites that still invoke the IE engine to render external content. | 7.8 | 24% | KEV |
| masshundreds of millions of Windows devices historically able to run Internet Explorer; exact currently-vulnerable count unknown | |
| CVE-2021-26411 | Use-After-Free Memory Corruption in Microsoft Internet Explorer Exploited in the Wild CVE-2021-26411 is a use-after-free (CWE-416) memory corruption vulnerability in Microsoft Internet Explorer's web rendering engine that can lead to remote code execution. It is triggered when a user, typically lured via a link, email, or watering-hole page, views attacker-controlled web content that corrupts memory, consistent with the CVSS profile requiring network access and user interaction. A successful attacker gains code execution in the context of the logged-on user, which in observed campaigns was chained into malware delivery (including exploit-kit payloads such as Dridex and VBA-based malware). Any Windows system that renders web content with Internet Explorer or its IE/MSHTML components (Edge is also listed among affected CPE products) is potentially affected, though specific version ranges are not provided in the source data. The flaw was exploited as a zero-day around Microsoft's March 2021 Patch Tuesday, was added to CISA KEV on 2021-11-03 with known ransomware use, and carries an 80.8% EPSS probability of exploitation within 30 days. Do: Apply Microsoft's March 2021 cumulative security updates for Internet Explorer, or any later cumulative update, across all Windows clients and servers, prioritizing user workstations per the CISA KEV required action. Review proxy and endpoint logs for visits to compromised watering-hole sites (notably Korean-language news sites) and for follow-on malware such as Dridex, and restrict or disable IE/legacy IE-mode rendering of untrusted web content where feasible. | 8.8 | 81% | KEV ransomware |
| mass≈hundreds of millions of Windows endpoints (IE/MSHTML components are present on effectively all supported Windows clients and servers) |
Full article416 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 18, 2021
A North Korean threat actor has been discovered taking advantage of two exploits in Internet Explorer to infect victims with a custom implant as part of a strategic web compromise (SWC) targeting a South Korean online newspaper.
Cybersecurity firm Volexity attributed the watering hole attacks to a threat actor it tracks as InkySquid, and more widely known by the monikers ScarCruft and APT37. Daily NK, the publication in question, is said to have hosted the malicious code from at least late March 2021 until early June 2021.
The "clever disguise of exploit code amongst legitimate code" and the use of custom malware enables the attackers to avoid detection, Volexity researchers said.
The attacks involved tampering with the jQuery JavaScript libraries hosted on the website to serve additional obfuscated JavaScript code from a remote URL, using it to leverage exploits for two Internet Explorer flaws that were patched by Microsoft in August 2020 and March 2021. Successful exploitation resulted in the deployment of a Cobalt Strike stager and novel backdoor called BLUELIGHT.
- CVE-2020-1380 (CVSS score: 7.5) - Scripting Engine Memory Corruption Vulnerability
- CVE-2021-26411 (CVSS score: 8.8) - Internet Explorer Memory Corruption Vulnerability
It's worth noting that both the flaws have been actively exploited in the wild, with the latter put to use by North Korean hackers to compromise security researchers working on vulnerability research and development in a campaign that came to light earlier this January.
In a separate set of attacks disclosed last month, an unidentified threat actor was found exploiting the same flaw to deliver a fully-featured VBA-based remote access trojan (RAT) on compromised Windows systems.
BLUELIGHT is used as a secondary payload following the successful delivery of Cobalt Strike, functioning as a full-featured remote access tool that provides complete access to a compromised system.
In addition to gathering system metadata and information about installed antivirus products, the malware is capable of executing shellcode, harvesting cookies and passwords from Internet Explorer, Microsoft Edge, and Google Chrome browsers, collecting files and downloading arbitrary executables, the results of which are exfiltrated to a remote server.
"While SWCs are not as popular as they once were, they continue to be a weapon in the arsenal of many attackers," the researchers noted. "The use of recently patched exploits for Internet Explorer and Microsoft Edge will only work against a limited audience."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/08/nk-hackers-deploy-browser-exploit-on.html