Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs

guest · Jul 29, 2021

Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs
July 29, 2021
https://thehackernews.com/2021/07/hackers-exploit-microsoft-browser-bug.html

An unidentified threat actor has been exploiting a now-patched zero-day flaw in Internet Explorer browser to deliver a fully-featured VBA-based remote access trojan (RAT) capable of accessing files stored in compromised Windows systems, and downloading and executing malicious payloads as part of an "unusual" campaign.

The backdoor is distributed via a decoy document named "Manifest.docx" that loads the exploit code for the vulnerability from an embedded template, which, in turn, executes shellcode to deploy the RAT, according to cybersecurity firm Malwarebytes, which spotted the suspicious Word file on July 21, 2021.
Click to expand...

The Internet Explorer exploit is one of the two ways that's used to deploy the RAT, with the other method relying on a social engineering component that involves downloading and executing a remote macro-weaponized template containing the implant. Regardless of the infection chain, the use of double attack vectors is likely an attempt to increase the likelihood of finding a path into the targeted machines.

"While both techniques rely on template injection to drop a full-featured remote access trojan, the IE exploit (CVE-2021-26411) previously used by the Lazarus APT is an unusual discovery," Malwarebytes researcher Hossein Jazi said in a report shared with The Hacker News. "The attackers may have wanted to combine social engineering and exploit to maximize their chances of infecting targets."
Click to expand...

Also discovered by Malwarebytes is a PHP-based panel nicknamed "Ekipa" that's used by the adversary to track victims and view information about the modus operandi that led to the successful breach, highlighting successful exploitation using the IE zero-day and the execution of the RAT.
Click to expand...

Malwarebytes: Crimea “manifesto” deploys VBA Rat using double attack vectors

This Rat has several different capabilities including downloading, uploading and executing files. The second template is an exploit for CVE-2021-26411 which executes a shell-code to deploy the same VBA Rat. The VBA Rat is not obfuscated but still has used some interesting techniques for shell-code injection.
Click to expand...

Log in or Sign up

Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs

guest Guest

Log in or Sign up

Hackers Exploit Microsoft Browser Bug to Deploy VBA Malware on Targeted PCs

guest Guest

Useful Searches