A hacker group is now targeting Afghanistan and India as they exploit a now-patched, 20-year-old flaw affecting Microsoft Office to deploy remote access trojans (RATs) that allow the adversary gain complete control over the compromised endpoints.
This has been attributed to a “lone wolf” threat actor operating a Lahore-based fake IT company called Bunse Technologies as a front to carry out the malicious activities.
The attacks work by taking advantage of political and government-themed lure domains that host the malware payloads, with the infection chains leveraging weaponized RTF documents and PowerShell scripts that distribute malware to victims. Specifically, the laced RTF files were found exploiting CVE-2017-11882 to execute a PowerShell command that’s responsible for deploying additional malware to conduct reconnaissance on the machine.
CVE-2017-11882 has to do with a memory corruption vulnerability capable of being abused to run arbitrary code. This flaw has been in existence since 2000 and was eventually addressed by Microsoft as part of its Patch Tuesday updates for November 2017.
After the recon phase a similar attack whereby the aforementioned vulnerability runs a series of instructions culminating in the installation of commodity malware such as DcRAT and QuasarRat that comes with a variety of functionalities right out of the box including remote shells, keylogging and credential theft thus requiring minimal effort on the part of the attacker.
The cybercrime operation has been observed to possess browser credential stealer for Brave, Mozilla Firefox, Google Chrome and Yandex Browser.
“This campaign is a classic example of an individual threat actor employing political, humanitarian and diplomatic themes in a campaign to deliver commodity malware to victims,” the researchers said. Commodity RAT families are increasingly being used by both crimeware and APT groups to infect their targets. These families also act as excellent launch pads for deploying additional malware against their victims.”