JSC GREC Makeyev and other Russian entities under attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article610 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 26, 2021
A cyberespionage campaign hit multiple Russian organizations, including JSC GREC Makeyev, a major defense contractor, exploiting a recently disclosed zero-day.
Security researchers from Malwarebytes uncovered multiple attacks targeting many Russian organizations, including JSC GREC Makeyev, a company that develops liquid and solid fuel for Russia’s ballistic missiles and space rocket program.
Threat actors behind the cyberespionage campaign orchestrated spear-phishing attacks, the messages sent to the target organizations used weaponized Office documents.
The documents were crafted to exploit the CVE-2021-40444 Internet Explorer flaw and pose to be sent by the company’s HR department.
Recently Microsoft has warned of multiple threat actors, including ransomware operators, that are exploiting the recently patched Windows MSHTML remote code execution security flaw (CVE-2021-40444) in attacks against organizations.
The IT giant says that threat actors started targeting this issue on August 18, before Microsoft shared mitigation for this vulnerability, threat actors used weaponized Office documents. The campaigns observed in August 2021 likely employed emails impersonating contracts and legal agreements, the messages used documents that were hosted on file-sharing sites.
Now Malwarebytes observed multiple attacks exploiting the same MSHTML vulnerability aimed at Russian entities.
“The email claims to come from the Human Resources (HR) department of the organization.
It says that HR is performing a check of the personal data provided by employees. The email asks employees to please fill out the form and send it to HR, or reply to the mail. When the receiver wants to fill out the form they will have to enable editing. And that action is enough to trigger the exploit.” reads the post published by Malwarebytes.
“The attack depends on MSHTML loading a specially crafted ActiveX control when the target opens a malicious Office document. The loaded ActiveX control can then run arbitrary code to infect the system with more malware.”
Another bait document used in the attacks claims to originate from the Ministry of the Interior in Moscow. The name of the document translates to “Notification of illegal activity,” its content asks the recipient to fill out the form and return it to the Ministry of Internal affairs or reply to this email within 7 days.
The nature of the targets suggests that the attacks were part of a cyberespionage campaign carried out by a state-sponsored actor, but at the time of this writing the experts did not attribute it to a specific actor.
A joint report published by Rostelecom-Solar and the FSB National Coordination Center for Computer Incidents (NKTsKI) revealed in May that foreign hackers have stolen information from Russian federal agencies.
The attacks were spotted in 2020, threat actors leveraged spear-phishing attacks, exploitation of vulnerabilities in web applications, hacking the infrastructure of contractors to penetrate the infrastructure of the Russian federal executive authorities.
Experts believe that threat actors behind the intrusions are sophisticated cyber mercenaries engaged by a foreign state.
Early this year, the Russian intelligence agency FSB issued a security alert to warn Russian organizations of potential cyberattacks launched by the United States in response to the SolarWinds supply chain attack.The alert was issued after officials of the new Biden administration declared that attacks like the SolarWinds ones could trigger a response of their government.
The Russian government always denied any involvement in the SolarWinds attack. The Russian National Coordination Center for Computer Incidents (NKTSKI) published a security bulletin to warn Russian businesses of the imminent risk of cyber attacks as a retaliation for the SolarWinds attacks that US Government agencies attributed to Moscow.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, JSC GREC Makeyev)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/122589/hacking/jsc-grec-makeyev-russia-orgs-attacks.html