Russian group RomCom exploited Firefox and Tor Browser zero-days to target attacks Europe and North America
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-49039 | Windows Task Scheduler Elevation-of-Privilege Flaw Actively Exploited in the Wild CVE-2024-49039 is an elevation-of-privilege vulnerability (CWE-287, improper authentication) in the Microsoft Windows Task Scheduler, scored 8.8 (High) with a local attack vector, low required privileges, and a changed scope indicating the exploit crosses a security boundary. A local attacker with limited user privileges can trigger the flaw through Task Scheduler to gain elevated rights on the affected system, typically SYSTEM- or administrator-level control, with no user interaction required. Every supported Windows desktop and server release in the vendor's affected list is impacted, since Task Scheduler is a core component of the operating system. The flaw was patched as an actively exploited zero-day in the November 2024 Patch Tuesday release, was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, and ransomware operators are known to use it. With an EPSS of 14.2% (96th percentile), defenders should treat this as a high-priority local privilege escalation for privilege-chaining and ransomware campaigns. Do: Apply the November 2024 Windows security updates across all affected Windows 10, Windows 11, and Windows Server branches, prioritizing servers, jump hosts, and machines used by privileged users given confirmed ransomware use. Confirm no supported Windows host is left unpatched, review local task creation and authentication logs for signs of privilege escalation, and follow CISA's required action to apply vendor mitigations or discontinue use if patches are unavailable. | 8.8 | 14% | KEV ransomware |
| masshundreds of millions of Windows systems (Task Scheduler ships with every Windows 10, Windows 11, and Windows Server installation) | |
| CVE-2024-9680 | Use-After-Free in Mozilla Firefox Animation Timelines Allows Code Execution Mozilla Firefox and Firefox ESR contain a use-after-free (CWE-416) in the browser's animation timelines component, which CISA describes as allowing code execution in the content process. The flaw is reachable through malicious web content: a crafted page can manipulate animation timelines so that an in-use object is freed, producing exploitable memory corruption. A successful attacker gains code execution in the content process, the sandboxed process that renders web pages, on the machine of the user who loaded the content. All users of Firefox and Firefox ESR are affected by the flaw itself. It is being actively exploited: the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-10-15 with known ransomware use, and EPSS assigns it a 23.2% probability of exploitation in the next 30 days (98th percentile). Do: Apply Mozilla's patched Firefox/Firefox ESR release immediately and verify the running version via the browser's About Firefox dialog, since many installs only pick up auto-updates after a restart (per CISA's required action: apply mitigations per vendor instructions or discontinue use). Given the known ransomware use, prioritize enterprise ESR rollout and check for managed-update failures, auto-update-disabled installs, or unmanaged Firefox copies on user machines. Note that no public proof-of-concept is known, but KEV listing confirms exploitation, so patching should not wait for PoC availability. | 9.8 | 23% | KEV ransomware |
| masshundreds of millions of users (Firefox's global desktop user base of roughly 150-200M active users, plus enterprise Firefox ESR deployments) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | correctiv.sbs | the RomCom backdoor from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that between October 10 |
| domain | cwise.store | from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that between October 10 and November 4, 20 |
| domain | journalctd.live | ding and executing the RomCom backdoor from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store. ESET reported that be |
Full article564 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 27, 2024
The Russian RomCom group exploited Firefox and Tor Browser zero-day vulnerabilities in attacks on users in Europe and North America.
Russian-based cybercrime group RomCom (aka UAT-5647, Storm-0978, Tropical Scorpius, UAC-0180, UNC2596) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America.
The first zero-day exploited by the Russian group, is a use-after-free issue, tracked as CVE-2024-9680, in Firefox.
The vulnerability CVE-2024-9680 resides in Animation timelines. Firefox Animation Timelines is a feature in the Firefox Developer Tools suite that allows developers to inspect, edit, and debug animations directly within the browser. It provides a visual interface for managing animations, including CSS animations and transitions, as well as those created with the Web Animations API.
An attacker could exploit this vulnerability to achieve code execution in the content process.
The second zero-day exploited by the threat actor is CVE-2024-49039. The issue is a Windows Task Scheduler privilege escalation flaw that allows AppContainer escape, enabling low-privileged users to run code at Medium integrity. Discovered by multiple researchers, it is actively exploited, especially across different regions, highlighting its potential impact.
RomCom chained the two vulnerabilities to compromise victims’ systems without user interaction. Victims were infected with the group’s backdoor by simply tricking them into visiting a maliciously crafted website.
“The compromise chain is composed of a fake website that redirects the potential victim to the server hosting the exploit, and should the exploit succeed, shellcode is executed that downloads and executes the RomCom backdoor.” reads the report published by ESET.
From October 10–16, 2024, attackers exploited unpatched browsers via fake websites that dropped payloads with no user interaction. Victims were redirected to legitimate sites afterward to avoid suspicion. According to ESET, the attackers used fake servers with recurring prefixes or suffixes like “redir” or “red” in domain names.
When a user visits the specially crafted websites using a vulnerable browser, an exploit triggers shellcode execution, using Reflective DLL Injection (RDI) to escape Firefox’s sandbox. This leads to downloading and executing the RomCom backdoor from C2 servers like journalctd[.]live, correctiv[.]sbs, or cwise[.]store.
ESET reported that between October 10 and November 4, 2024, websites hosting the exploit primarily targeted victims in Europe and North America, with up to 250 victims per country.
“Chaining together two zero-day vulnerabilities armed RomCom with an exploit that requires no user interaction. This level of sophistication shows the threat actor’s will and means to obtain or develop stealthy capabilities.” concludes the report. “ESET shared detailed findings with Mozilla, following our coordinated vulnerability disclosure process shortly after discovery. Mozilla released a blogpost about how they reacted to the disclosure and were able to release a fix within 25 hours, which is very impressive in comparison to industry standards.”
In October 2024, Cisco Talos researchers observed Russia-linked threat actor RomCom targeting Ukrainian government agencies and Polish entities in a new wave of attacks since at least late 2023.
In the recent attacks, RomCom deployed an updated variant of the RomCom RAT dubbed ‘SingleCamper.’ SingleCamper is loaded directly from registry into memory and relies on a loopback address to communicate with its loader. The threat actors also employed two new downloaders, called RustClaw and MeltingClaw, plus two backdoors, DustyHammock (Rust-based) and C++-based ShadyHammock
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Russia)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/171443/apt/russia-romcom-group-firefox-tor-browser-zero-day.html