MLNK Builder 4.2 released in Dark Web – malicious shortcut
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) CVE-2022-30190 (Follina) is a remote code execution flaw in the Microsoft Windows Support Diagnostic Tool (MSDT) when MSDT is invoked through its ms-msdt URL protocol by a calling application such as Microsoft Word. Attackers trigger it by luring a user into opening a malicious document — typically a Word/RTF file whose link or remotely linked template launches the ms-msdt: URI with attacker-supplied commands — and CVSS 3.1 rates it 7.8 with a local attack vector and required user interaction. A successful exploit runs arbitrary code with the privileges of the calling application, allowing the attacker to install programs, view, change or delete data, or create new accounts in the user's context. Per the CISA data, affected platforms are Windows 7, 8.1 and RT 8.1, Windows 10 versions 1507 through 21H2, Windows 11 21H2, and Windows Server 2008 and 2012 — essentially any Windows installation that ships MSDT, with Office/Word as the common delivery vector. Exploitation is confirmed in the wild: Microsoft acknowledged it as an exploited zero-day, CISA added it to the KEV on 2022-06-14 with known ransomware use, EPSS puts the 30-day exploitation probability at 99.2% (99th percentile), and contemporaneous reporting also tied its use to espionage actors including APT28. Do: Apply Microsoft's security updates per vendor instructions (the fix shipped in the June 2022 Patch Tuesday releases for the affected Windows versions), as required by CISA's KEV. If patching must be delayed, follow Microsoft's documented mitigation to disable the MSDT URL protocol (remove or restrict the HKEY_CLASSES_ROOT\ms-msdt registry key) and enforce Office Protected View / block Word from fetching remote templates over the network. Hunt for exploitation by checking whether Office processes (WINWORD.exe) launch msdt.exe or sdiagnhost.exe, or whether ms-msdt: URIs are invoked unexpectedly. | 7.8 | 99% | KEV ransomware PoC |
| mass≈1 billion+ Windows devices (effectively the entire supported Windows installed base) |
Full article478 words · extracted from securityaffairs.com · click to collapse
Cybercriminals released a new MLNK Builder 4.2 tool for malicious shortcuts (LNK) generation with an improved Powershell and VBS Obfuscator
Resecurity, Inc. (USA), a Los Angeles-based cybersecurity company protecting Fortune 500 worldwide, has detected an update of one of the most popular tools used by cybercriminals to generate malicious LNK files, so frequently used for malicious payloads delivery nowadays.
MLNK Builder has emerged in Dark Web with the new version (4.2) and the updated feature-set focused on AV evasion and masquerading with icons of popular legitimate applications and file formats.
“Why Attackers Use LNK File? Such files typically look legitimate, and may have an icon the same as an existing application or document. The bad actors incorporate malicious code into LNK files (e.g. Powershell scenario) allowing the execution of the payload on the target machine.” reads the post published by Resecurity.
The spike of notable campaigns involving malicious shortcuts (LNK files) conducted by both APT groups and advanced cybercriminals has been detected in April-May period this year – Bumblebee Loader and UAC-0010 (Armageddon) targeting EU Countries described by CERT UA. Malicious shortcuts continue to give a hard time for network defenders, especially, in combating global botnet and ransomware activity using them as a channel for multi-staged payload delivery.
“We observed a campaign that delivered Bumblebee through contact forms on a target’s website. The messages claimed that the website used stolen images and included a link that ultimately delivered an ISO file containing the malware.” continues the post. “Resecurity attributed this campaign to another threat actor the company tracks as TA578 and has done since May 2020. TA578 uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader, as well as Cobalt Strike.”
According to experts from Resecurity, existing customers of MLNK Builder will receive an update for free, but the authors have also released a “Private Edition” available for a tight circle of vetted customers or additional license in $125 per build.
The updated tool provides a rich arsenal to generate malicious files looking like legitimate Microsoft Word, Adobe PDF, ZIP Archives, images .JPG/.PNG, audio MP3, and even video .AVI files. as well as more advanced features to obfuscate malicious payload.
Bad actors continue to develop more creative ways to trick detection mechanisms and deliver malicious payloads – by leveraging a combination of extensions and different file formats, as well as Living Off the Land Binaries (LOLbins).
According to Resecurity, the most actively used malware families leveraging LNK-based distribution are TA570 Qakbot (aka Qbot), IcedID, AsyncRAT, and the new strain of Emotet. The most recent Qakbot distribution campaign also included malicious Word documents using the CVE-2022-30190 (Follina) zero-day vulnerability in the Microsoft Support Diagnostic Tool (MSDT).
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, MLNK Builder)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/133381/cyber-crime/mlnk-builder-4-2-released-dark-web.html