Ukrainian Institutions Targeted Using HATVIBE and CHERRYSPY Malware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-23692 | Unauthenticated Template Injection RCE in Rejetto HTTP File Server 2.3m Rejetto HTTP File Server (HFS), a free Windows-based file-sharing server, contains a template injection vulnerability (CWE-94/CWE-1336) in versions up to and including 2.3m that allows a remote, unauthenticated attacker to execute arbitrary commands by sending a specially crafted HTTP request. The flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.8 Critical), and the affected 2.3m release is no longer supported by the vendor. Any system running Rejetto HFS 2.3m or earlier is affected, with instances exposed directly to the internet at the greatest risk. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2024-07-09 with known ransomware use, EPSS assigns a 99.5% probability of exploitation within 30 days, and public PoCs and a Metasploit module are available. Related reporting on Russia-aligned TAG-110 activity (HATVIBE/CHERRYSPY malware) against Ukrainian institutions highlights active targeting around the same period. Do: Because HFS 2.3m is end-of-life with no fixed 2.x version indicated in the available data, follow CISA's required action: apply mitigations per vendor instructions or discontinue use of the product, and at minimum remove it from direct internet exposure (firewall/ACL rules or VPN-only access). Hunt for compromise by checking HFS access logs for crafted HTTP requests containing template/macro syntax and the HFS service process for unexpected child processes. Organizations subject to CISA KEV remediation deadlines should prioritize this fix given the 9.8 Critical severity, 99.5% EPSS, and known ransomware use. | 9.8 | 99% | KEV ransomware PoC ×5 |
| largetens of thousands of internet-exposed HFS 2.3m instances (order of magnitude 10k–100k systems) |
Full article328 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 23, 2024Cyber Espionage / Malware
The Computer Emergency Response Team of Ukraine (CERT-UA) has alerted of a spear-phishing campaign that targeted a scientific research institution in the country with malware known as HATVIBE and CHERRYSPY.
The agency attributed the attack to a threat actor it tracks under the name UAC-0063, which was previously observed targeting various government entities to gather sensitive information using keyloggers and backdoors.
The attack is characterized by the use of a compromised email account belonging to an employee of the organization to send phishing messages to "dozens" of recipients containing a macro-laced Microsoft Word (DOCX) attachment.
Opening the document and enabling macros results in the execution of an encoded HTML Application (HTA) named HATVIBE, which sets up persistence on the host using a scheduled task and paves the way for a Python backdoor codenamed CHERRYSPY, which is capable of running commands issued by a remote server.
CERT-UA said it detected "numerous cases" of HATVIBE infections that exploit a known security flaw in HTTP File Server (CVE-2024-23692, CVSS score: 9.8) for initial access.
UAC-0063 has been associated with a Russia-linked nation-state group dubbed APT28 with moderate confidence. APT28, which is also referred to as BlueDelta, Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422, is affiliated with Russia's strategic military intelligence unit, the GRU.
The development comes as CERT-UA detailed another phishing campaign targeting Ukrainian defense enterprises with booby-trapped PDF files embedding a link that, when clicked, downloads an executable (aka GLUEEGG), which is responsible for decrypting and running a Lua-based loader called DROPCLUE.
DROPCLUE is designed to open a decoy document to the victim, while covertly downloading a legitimate Remote Desktop program called Atera Agent using the curl utility. The attack has been linked to a cluster tracked as UAC-0180.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/07/ukrainian-institutions-targeted-using.html