Iranian threat actors exploit MS MSHTML bug to steal Google and Instagram credentials
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | 858404225565c80972ba66d2c612e49f | 2021 by ShadowChasing. hi threat why did you use it 😀 ITW:858404225565c80972ba66d2c612e49f filename:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word. |
| url | http://hr.dedyn.io/1.ps1 | L: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/uploa |
| url | http://hr.dedyn.io/upload2.aspx | hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/upload2.aspx pic.twitter.com/fHsgAshCNc — Shadow Chaser Group (@ShadowCh |
| url | http://hr.dedyn.io/upload.aspx?fn= | d.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= hxxp://hr.dedyn.io/upload2.aspx pic.twitter.com/fHsgAshCNc |
| url | http://hr.dedyn.io/word.cab | name:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp://hr.dedyn.io/upload.aspx?fn= |
| url | http://hr.dedyn.io/word.html | 5565c80972ba66d2c612e49f filename:جنایات خامنه ای.docx URL: hxxp://hr.dedyn.io/word.html hxxp://hr.dedyn.io/word.cab hxxp://hr.dedyn.io/1.ps1 hxxp:/ |
Full article651 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 25, 2021
An Iranian threat actor is stealing Google and Instagram credentials of Farsi-speaking targets by exploiting a Microsoft MSHTML bug.
Researchers from SafeBreach Labs have identified a new Iranian threat actor that is exploiting a Microsoft MSHTML Remote Code Execution (RCE) vulnerability in attacks targeting Farsi-speaking victims. The exploit is used to install a PowerShell stealer, tracked by the researchers as PowerShortShell, that steals Google and Instagram credentials of the victims.
The campaign was first spotted in mid-September 2021 by ShadowChasing.
hi threat
— Shadow Chaser Group (@ShadowChasing1) September 15, 2021
why did you use it 😀
ITW:858404225565c80972ba66d2c612e49f
filename:جنایات خامنه ای.docx
URL:
hxxp://hr.dedyn.io/word.html
hxxp://hr.dedyn.io/word.cab
hxxp://hr.dedyn.io/1.ps1
hxxp://hr.dedyn.io/upload.aspx?fn=
hxxp://hr.dedyn.io/upload2.aspx pic.twitter.com/fHsgAshCNc
The PowerShortShell stealer is also used for Telegram surveillance and gathering system information from infected systems.
“SafeBreach Labs analyzed the full attack chain, discovered new phishing attacks which started in July this year and achieved the last and most interesting piece of the puzzle – the PowerShell Stealer code – which we named PowerShortShell.” reads the analysis published by SafeBreach Labs. “The reason we chose this name is due to the fact that the stealer is a PowerShell script, short with powerful collection capabilities – in only ~150 lines, it provides the adversary a lot of critical information including screen captures, telegram files, document collection, and extensive data about the victim’s environment.”
The campaign targets Windows users; the attack chain starts with spear-phishing emails using malicious Winword attachments that exploit a Microsoft MSHTML remote code execution (RCE) flaw tracked as CVE-2021-40444.
Most of the victims are located in the United States, and threat actors use the “Corona massacre” lure, a circumstance that confirms the attackers are targeting Iranians who live abroad. Upon opening the document, a DLL is dropped on the target system, and then it is used to execute the PowerShortShell stealer payload.
The PowerShortShell collects data and exfiltrates it to a C2 server under the control of the attacker.
“The adversary might be tied to Iran’s Islamic regime since the Telegram surveillance usage is typical of Iran’s threat actors like Infy, Ferocious Kitten, and Rampant Kitten. Surprisingly, the usage of exploits for the infection is quite unique to Iranian threat actors which in most cases heavily rely on social engineering tricks.” continues the experts.
In mid-September, Microsoft reported that multiple threat actors, including ransomware operators, were exploiting the recently patched Windows MSHTML remote code execution security flaw (CVE-2021-40444) in attacks against organizations. The IT giant said that threat actors started targeting this issue on August 18, before Microsoft shared mitigation for this vulnerability, the attackers used weaponized Office documents. The campaigns observed in August 2021 likely employed emails impersonating contracts and legal agreements, the messages used documents that were hosted on file-sharing sites.
“In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.” reads the post published by Microsoft. “These loaders communicated with an infrastructure that Microsoft associates with multiple cybercriminal campaigns, including human-operated ransomware.”
Experts noticed that loaders employed in the attacks connected with the C2 infrastructure connected with several cybercrime campaigns, including ransomware operators.
MSTIC researchers tracked a large cluster of malicious activity involving Cobalt Strike infrastructure under the name DEV-0365, which has many similarities with another Cobalt Strike infrastructure that suggests it was managed by a third-party threat actor.
Experts pointed out that the availability of information about the CVE-2021-40444 issue shared online allowed threat actors to create their own exploit
The report published by SafeBreach also includes indicators of compromise for the attacks orchestrated by the Iranian threat actors.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, MSHTML)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124984/apt/iran-apt-microsoft-mshtml-exploit.html