US organizations targeted with emails delivering NetSupport RAT
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36025 | Windows SmartScreen Bypass (CVE-2023-36025) Exploited via Crafted Shortcut Files CVE-2023-36025 is a security feature bypass in Windows SmartScreen in which a specially crafted file — exploited in the wild using Internet Shortcut (.url) files — evades the Mark-of-the-Web warning SmartScreen normally displays for content downloaded from the internet. The flaw is network-reachable and requires no authentication, but user interaction is required: it triggers when a user clicks the crafted file delivered via phishing email, chat, or a web download. By bypassing the SmartScreen prompt, the attacker removes a key user-facing defense that would otherwise flag or warn about the file, which facilitated delivery of malware in the observed DarkGate and Mispadu campaigns. Any unpatched Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (21H2, 22H2, 23H2), or Windows Server 2008/2012/2016/2019 system is affected, which at the time of disclosure effectively meant the entire supported Windows installed base. It is confirmed exploited in the wild: CISA added it to the KEV catalog on 2023-11-14, EPSS scores 30-day exploitation probability at 88.1% (100th percentile), though no public PoC is known. Do: Apply Microsoft's November 2023 cumulative Windows security updates (the release containing the fix) on all affected Windows 10/11 and Windows Server systems; no configuration-based workaround is widely documented, so patching is the primary mitigation. Until patched, treat unexpected Internet Shortcut (.url) files arriving via email or chat with extra suspicion, since they can execute without the usual SmartScreen warning, and hunt for DarkGate/Mispadu indicators. Given the KEV listing and 88.1% EPSS, prioritize this fix in the current patch cycle; ransomware-associated use is reported as unknown. | 8.8 | 88% | KEV |
| mass>1 billion endpoints (effectively the entire supported Windows 10/11/Server installed base at the time of disclosure) |
Full article311 words · extracted from helpnetsecurity.com · click to collapse
Employees at US-based organizations are being targeted with emails delivering NetSupport RAT malware via “nuanced” exploitation and by using an advanced detection evasion method.
The malware campaign
The campaign, dubbed PhantomBlu, takes the form of email messages purportedly coming from a legitimate accounting service.
The attackers are leveraging a legitimate email delivery platform, “SendInBlue” or Brevo service, to evade detection.
The phishing emails prompts recipients to download an attached Office Word file (.docx) to view their “monthly salary report”.
The PhantomBlu phishing email. (Source: Perception Point)
After downloading the file, victims are instructed to enter the provided password, click “enable editing”, and then double-click a printer image to view the “salary graph.”
But the clickable printer image is actually an Object Linking and Embedding (OLE) package, which is a Microsoft Windows feature that allows data and object sharing between applications.
Clicking on the printer icon triggers OLE template manipulation and opens an archived .zip file containing a single LNK file: a PowerShell dropper that retrieves and executes a script, which contains – among other things – an executable for the NetSupport RAT and a registry key designed to assure its persistence.
“This advanced technique bypasses traditional security measures by hiding the payload outside the document, only executing upon user interaction,” Perception Point researchers noted.
The NetSupport RAT
The NetSupport RAT is based on the legitimate remote desktop tool NetSupport Manager. It’s commonly used by attackers to infiltrate systems to set the stage for future attacks.
“Once installed on a victim’s endpoint, NetSupport can monitor behavior, capture keystrokes (keylogger), transfer files, commandeer system resources, and move to other devices within the network – all under the guise of a benign remote support software,” the researchers said.
(Other?) attackers have previously been spotted exploiting a vulnerability (CVE-2023-36025) in the Windows SmartScreen anti-phishing and anti-malware component to deliver the NetSupport RAT.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2024/03/22/emails-delivering-netsupport-rat/