AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit

guest · Jun 17, 2020

AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit
June 17, 2020
https://threatpost.com/acidbox-malware-uncovered-using-repurposed-virtualbox-exploit/156653/

Advanced malware, dubbed AcidBox, has been identified by researchers who say a mysterious cybergang used it twice against Russian organizations as far back as 2017. In a report released Wednesday, Palo Alto Networks’ Unit 42 sheds new light onto attacks against the popular open-source virtualization software VirtualBox that used the AcidBox malware.

Unit 42’s postmortem on the VirtualBox attacks begins in 2008 when researchers at Core Security found a bug in the Windows Vista security mechanism called Driver Signature Enforcement (DSE). The flaw allowed an attacker to disable DSE and install rogue software onto targeted instances of Oracle’s VirtualBox software. The bug (CVE-2008-3431) impacting VirtualBox driver VBoxDrv.sys was patched in version 1.6.4.

Fast forward to 2o14, and the notorious Turla Group developed the first malware to abused a third-party device driver to disable DSE, weaponizing Core Security’s research.
Click to expand...

“The exploit used by Turla actually abuses two vulnerabilities — of which, only one was ever fixed [with CVE-2008-3431],” Unit 42 wrote in its report posted Wednesday.
Fast forward to 2019, and that’s when Unit 42 said said it first discovered a sample of AcidBox that had been uploaded to VirusTotal.

“Because of the malware’s complexity, rarity, and the fact that it’s part of a bigger toolset, we believe it was used by an advanced threat actor for targeted attacks and it’s likely that this malware is still being used today if the attacker is still active,” wrote Dominik Reichel and Esmid Idrizovic, researchers with Palo Alto Networks’ Unit 42 team.
Click to expand...

Moving forward, AcidBox is a “very rare” malware that is probably used in highly targeted attacks, researchers said.
Click to expand...

Palo Alto Networks - Unit42: AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations

Log in or Sign up

AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit

guest Guest

Log in or Sign up

AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit

guest Guest

Useful Searches