Not Simply Criminals, But Governments Were Too Using Ms Give-And-Take 0-Day Exploit

Recently nosotros reported nigh a critical code execution vulnerability inwards Microsoft Word that was beingness exploited inwards the wild yesteryear cyber criminal groups to distribute malware similar Dridex banking trojans in addition to Latentbot.

Now, it turns out that the same previously undisclosed vulnerability inwards Word (CVE-2017-0199) was also actively beingness exploited yesteryear the government-sponsored hackers to spy on Russian targets since at to the lowest degree this January.

The intelligence comes after safety draw of piece of employment solid FireEye, that independently discovered this flaw final month, published a blog post, revealing that FinSpy spyware was installed equally early on equally Jan using the same vulnerability inwards Word that was patched on Tuesday yesteryear Microsoft.

For those unaware, the vulnerability (CVE-2017-0199) is a code execution flaw inwards Word that could permit an assaulter to accept over a fully patched in addition to upward to engagement figurer when the victim opens a Word document containing a booby-trapped OLE2link object, which downloads a malicious HTML app from a server, disguised equally a document created inwards Microsoft's RTF (Rich Text Format).

FinSpy or FinFisher is associated amongst the controversial UK-based draw of piece of employment solid Gamma Group, which sells so-called "lawful intercept" spyware to governments some the world.

"Though alone 1 Finspy user has been observed leveraging this zero-day exploit, the historical orbit of Finspy, a capability used yesteryear several nation-states, suggests other customers had access to it," FireEye researchers said. 

"Additionally, this incident exposes the global nature of cyber threats in addition to the value of worldwide perspective—a cyber espionage incident targeting Russians tin plough over the sack supply an chance to acquire nigh in addition to interdict criminal offense against English linguistic communication speakers elsewhere."

Months subsequently inwards March, the same then-zero-day vulnerability was used to install Latentbot, a bot-like, information-stealing in addition to remote-access malware bundle used yesteryear financially motivated criminals.

Latentbot has several malicious capabilities including credential theft, remote desktop functions, difficult drive in addition to information wiping, in addition to the mightiness to disable antivirus software.

FireEye said criminals used social engineering to play a joke on victims into opening the attachments amongst generic dependent area lines similar "hire_form.doc", "!!!!URGENT!!!!READ!!!.doc", "PDP.doc", in addition to "document.doc".

However, on Monday, the criminals behind the assault modified their crusade to deliver a unlike malware bundle called Terdot, which in addition to therefore installed software that uses the TOR anonymity service to cover the identity of the servers it contacted with.

According to FireEye researchers, the MS Word exploit used to install Finspy on Russian computers yesteryear authorities spies in addition to the 1 used inwards March to install Latentbot yesteryear criminal hackers was obtained from the same source.

This finding highlights that individual who initially discovered this zero-day vulnerability sold it to many actors, including the commercial companies who deals inwards buying in addition to selling of zero-day exploits equally good equally financially motivated online criminals.

Also, but Mon evening, Proofpoint researchers likewise discovered a massive crusade of spam email targeting millions of users across fiscal institutions inwards Commonwealth of Australia amongst the Dridex banking malware, again, yesteryear exploiting the same vulnerability inwards Word.

FireEye researchers are notwithstanding non certain of the root for the exploit that delivered the Dridex banking trojan, but it is possible that the vulnerability disclosure yesteryear McAfee final calendar week provided insight that helped Dridex operators utilization the flaw, or that individual amongst access to the Word exploit gave it to them.

Microsoft patched the MS Word vulnerability on Tuesday, which hackers, equally good equally authorities spies, had been exploiting it for months. So, users are strongly advised to install updates equally shortly equally possible to protect themselves against the ongoing attacks.

Share This :